{ "@id": "urn:uuid:a7175863-f4b6-448a-a558-fdd16d04bf43", "role": "Document Creator", "author": "https://tuxcare.com", "version": 15, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T18:16:43.407129+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T18:14:11.839373+00:00", "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 describes an infinite loop DoS in Netty 3.x SslHandler when processing SSLv2Hello messages. The target (Netty 4.1.31.Final) contains an upstream fix (commit fbe0e3506e7, authored by Scott Mitchell, shipped in 4.1.17.Final) that prevents BUFFER_OVERFLOW infinite loops via a two-consecutive-overflow detection mechanism at SslHandler.java:1331-1336. When SSLEngine returns BUFFER_OVER...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3488" }, "impact_statement": "not_affected \u2014 CVE-2014-3488 describes an infinite loop DoS in Netty 3.x SslHandler when processing SSLv2Hello messages. The target (Netty 4.1.31.Final) contains an upstream fix (commit fbe0e3506e7, authored by Scott Mitchell, shipped in 4.1.17.Final) that prevents BUFFER_OVERFLOW infinite loops via a two-consecutive-overflow detection mechanism at SslHandler.java:1331-1336. When SSLEngine returns BUFFER_OVER..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T12:48:08.430268+00:00", "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final, causing an infinite loop when SSL_write returns WANT_READ/WANT_WRITE with an empty BIO buffer. The target version 4.1.31.Final already contains the upstream fix from commit 9e2c400f89, which was released in Netty 4.1.1.Final (June 2016). The vulnerable code pattern is not present\u2014the fix causes the wrap() method to return immediately to the event loop instead of continuing an infinite loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4970" }, "impact_statement": "CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final, causing an infinite loop when SSL_write returns WANT_READ/WANT_WRITE with an empty BIO buffer. The target version 4.1.31.Final already contains the upstream fix from commit 9e2c400f89, which was released in Netty 4.1.1.Final (June 2016). The vulnerable code pattern is not present\u2014the fix causes the wrap() method to return immediately to the event loop instead of continuing an infinite loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 Netty 4.1.31.Final is NOT AFFECTED by CVE-2023-34462. The vulnerability requires SslClientHelloHandler, which reads a 3-byte handshake length field (up to 16MB). This class was introduced in February 2020, AFTER version 4.1.31.Final was released. Version 4.1.31.Final only has AbstractSniHandler, which reads 2-byte packet lengths (max 65KB). The architectural code path that enables 16MB-per-conn...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Netty 4.1.31.Final is NOT AFFECTED by CVE-2023-34462. The vulnerability requires SslClientHelloHandler, which reads a 3-byte handshake length field (up to 16MB). This class was introduced in February 2020, AFTER version 4.1.31.Final was released. Version 4.1.31.Final only has AbstractSniHandler, which reads 2-byte packet lengths (max 65KB). The architectural code path that enables 16MB-per-conn..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:43:58.356192+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.31.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T21:51:00.172163+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.31.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.31.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T21:51:00.172163+00:00", "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.31.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-44249" }, "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.31.Final-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T18:34:00.060063+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler. Version 4.1.31.Final is not affected by CVE-2026-45416. The vulnerable class SslClientHelloHandler and its eager buffer allocation logic were introduced after this version. The existing AbstractSniHandler implementation in 4.1.31.Final parses ClientHello messages in-place without reading the 24-bit handshake length field or allocating separate buffers based on attacker-controlled size values. The architecture predates the vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Version 4.1.31.Final is not affected by CVE-2026-45416. The vulnerable class SslClientHelloHandler and its eager buffer allocation logic were introduced after this version. The existing AbstractSniHandler implementation in 4.1.31.Final parses ClientHello messages in-place without reading the 24-bit handshake length field or allocating separate buffers based on attacker-controlled size values. The architecture predates the vulnerability." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-11-08T21:51:00.172163+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.31.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.31.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-11-13T18:16:43.407129+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.31.Final-tuxcare.4.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.31.Final-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.31.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T18:34:00.060063+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.31.Final-tuxcare.1 of io.netty:netty-handler. Target version 4.1.31.Final (Nov 2018) predates the introduction of SslClientHelloHandler.java (Feb 2020) which contains the vulnerable fragment aggregation code. The target uses AbstractSniHandler.java instead, which requires the entire ClientHello in a single TLS record and does not perform multi-record fragment aggregation, making the quadratic CPU vulnerability unreachable.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "Target version 4.1.31.Final (Nov 2018) predates the introduction of SslClientHelloHandler.java (Feb 2020) which contains the vulnerable fragment aggregation code. The target uses AbstractSniHandler.java instead, which requires the entire ClientHello in a single TLS record and does not perform multi-record fragment aggregation, making the quadratic CPU vulnerability unreachable." } ] }