{ "@id": "urn:uuid:b83830ff-5468-426b-9016-a0da15b924fe", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T10:17:22.662622+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T07:22:08.568536+00:00", "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 describes an infinite loop vulnerability in Netty's SslHandler when processing SSLv2Hello messages. The target Netty 4.1.21.Final is NOT AFFECTED because the upstream project already fixed this vulnerability class before this release. Commit fbe0e3506e7 (Scott Mitchell, 2017-10-30) added infinite-loop protection in the BUFFER_OVERFLOW handler that prevents the exact denial-of-serv...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3488" }, "impact_statement": "not_affected \u2014 CVE-2014-3488 describes an infinite loop vulnerability in Netty's SslHandler when processing SSLv2Hello messages. The target Netty 4.1.21.Final is NOT AFFECTED because the upstream project already fixed this vulnerability class before this release. Commit fbe0e3506e7 (Scott Mitchell, 2017-10-30) added infinite-loop protection in the BUFFER_OVERFLOW handler that prevents the exact denial-of-serv..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T07:22:08.568536+00:00", "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler. CVE-2016-4970 is NOT present in Netty 4.1.21.Final. The vulnerability affected versions before 4.1.1.Final, and the fix (commit 9e2c400f89) was included in the upstream 4.1.1.Final release in May 2016. The target version 4.1.21.Final (released February 2018) already contains the upstream fix. The vulnerable code pattern (infinite loop when SSL_write returns WANT_READ/WANT_WRITE with empty BIO buffer) has been fixed - the target code returns control to the event loop immediately instead of continuing to loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4970" }, "impact_statement": "CVE-2016-4970 is NOT present in Netty 4.1.21.Final. The vulnerability affected versions before 4.1.1.Final, and the fix (commit 9e2c400f89) was included in the upstream 4.1.1.Final release in May 2016. The target version 4.1.21.Final (released February 2018) already contains the upstream fix. The vulnerable code pattern (infinite loop when SSL_write returns WANT_READ/WANT_WRITE with empty BIO buffer) has been fixed - the target code returns control to the event loop immediately instead of continuing to loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T07:22:08.568536+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T07:22:08.568536+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T07:22:08.568536+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T07:22:08.568536+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 Target version 4.1.21.Final is NOT affected by CVE-2023-34462. The vulnerability exists in SslClientHelloHandler, which was introduced AFTER this version (commit 8304069a30). The target uses AbstractSniHandler which parses ClientHello messages in-place without pre-allocating buffers based on the attacker-controlled handshake length field. The vulnerable code pattern (handshakeBuffer = ctx.alloc...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Target version 4.1.21.Final is NOT affected by CVE-2023-34462. The vulnerability exists in SslClientHelloHandler, which was introduced AFTER this version (commit 8304069a30). The target uses AbstractSniHandler which parses ClientHello messages in-place without pre-allocating buffers based on the attacker-controlled handshake length field. The vulnerable code pattern (handshakeBuffer = ctx.alloc..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T07:22:08.568536+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.21.Final-tuxcare.3.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T07:22:08.568536+00:00", "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2025-24970" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T07:22:08.568536+00:00", "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler. Target version 4.1.21.Final is NOT AFFECTED by CVE-2026-44249. The CVE describes a vulnerability in the IpSubnetFilterRule.compareTo() method that uses networkAddress instead of subnetMask in a bitwise AND operation. Version 4.1.21.Final (released February 2018) does not have a compareTo() method - it was added 2.5 years later in September 2020. The target uses a matches() method that correctly applies subnetMask (line 156). While the target does have a signed BigInteger bug (line 170 missing unsigned parameter), this bug alone does not cause bypass vulnerabilities in the target's simpler code architecture where subnet masking is correctly implemented.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44249" }, "impact_statement": "Target version 4.1.21.Final is NOT AFFECTED by CVE-2026-44249. The CVE describes a vulnerability in the IpSubnetFilterRule.compareTo() method that uses networkAddress instead of subnetMask in a bitwise AND operation. Version 4.1.21.Final (released February 2018) does not have a compareTo() method - it was added 2.5 years later in September 2020. The target uses a matches() method that correctly applies subnetMask (line 156). While the target does have a signed BigInteger bug (line 170 missing unsigned parameter), this bug alone does not cause bypass vulnerabilities in the target's simpler code architecture where subnet masking is correctly implemented." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T07:22:08.568536+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler. Netty version 4.1.21.Final is NOT AFFECTED by CVE-2026-45416. The vulnerability exists in SslClientHelloHandler.decode(), which handles multi-record TLS ClientHello messages by reading a 24-bit handshake length field and eagerly allocating ctx.alloc().buffer(handshakeLength). This class does not exist in version 4.1.21.Final. Instead, this version uses AbstractSniHandler (extending ByteToMessageDecoder directly) that parses ClientHello inline from the input buffer without reading the 24-bit handshake length field or performing eager allocation. The vulnerable code path was introduced in a later version when SslClientHelloHandler was added to support fragmented ClientHello messages. Backports of this CVE exist for versions 4.1.63.Final and later (which do have SslClientHelloHandler), but no backport exists for 4.1.21.Final, confirming it does not need the fix. The attack chain (multi-record ClientHello \u2192 read handshake length \u2192 eager allocation) is absent in this version.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Netty version 4.1.21.Final is NOT AFFECTED by CVE-2026-45416. The vulnerability exists in SslClientHelloHandler.decode(), which handles multi-record TLS ClientHello messages by reading a 24-bit handshake length field and eagerly allocating ctx.alloc().buffer(handshakeLength). This class does not exist in version 4.1.21.Final. Instead, this version uses AbstractSniHandler (extending ByteToMessageDecoder directly) that parses ClientHello inline from the input buffer without reading the 24-bit handshake length field or performing eager allocation. The vulnerable code path was introduced in a later version when SslClientHelloHandler was added to support fragmented ClientHello messages. Backports of this CVE exist for versions 4.1.63.Final and later (which do have SslClientHelloHandler), but no backport exists for 4.1.21.Final, confirming it does not need the fix. The attack chain (multi-record ClientHello \u2192 read handshake length \u2192 eager allocation) is absent in this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3" } } ], "timestamp": "2026-11-05T10:17:22.662622+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.21.Final-tuxcare.4.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.21.Final-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T07:22:08.568536+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T07:22:08.568536+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler. Target version 4.1.21.Final (released Feb 2018) does not contain the vulnerable SslClientHelloHandler class, which was introduced in Feb 2020 (commit 8304069a30). The target uses AbstractSniHandler, a different implementation that does NOT accumulate ClientHello fragments across multiple TLS records and has no handshakeBuffer clear+recopy pattern. When a fragmented ClientHello arrives, AbstractSniHandler parses only the first TLS record; if incomplete, it falls back to the default SSL context and removes itself from the pipeline. No subsequent decode() calls occur, preventing any O(n\u00b2) re-copying. The ByteToMessageDecoder parent class cumulation is append-only with no clear() operation. The attack chain from fragmented input to quadratic CPU consumption does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "Target version 4.1.21.Final (released Feb 2018) does not contain the vulnerable SslClientHelloHandler class, which was introduced in Feb 2020 (commit 8304069a30). The target uses AbstractSniHandler, a different implementation that does NOT accumulate ClientHello fragments across multiple TLS records and has no handshakeBuffer clear+recopy pattern. When a fragmented ClientHello arrives, AbstractSniHandler parses only the first TLS record; if incomplete, it falls back to the default SSL context and removes itself from the pipeline. No subsequent decode() calls occur, preventing any O(n\u00b2) re-copying. The ByteToMessageDecoder parent class cumulation is append-only with no clear() operation. The attack chain from fragmented input to quadratic CPU consumption does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.21.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T07:22:08.568536+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.21.Final-tuxcare.3 of io.netty:netty-handler." } ] }