{ "@id": "urn:uuid:d124af51-7c10-49f2-af52-6cd2fca0c520", "role": "Document Creator", "author": "https://tuxcare.com", "version": 13, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T08:08:20.959393+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T18:11:18.943331+00:00", "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x where SSLv2Hello messages requiring large buffers (>30KB) caused infinite loops on BUFFER_OVERFLOW. Netty 4.1.39.Final is not vulnerable because commit fbe0e3506e (Oct 2017, Scott Mitchell/Apple) added a defense that detects two consecutive BUFFER_OVERFLOW events with no progress and throws an exception to break the loop. This fix was in upstream Netty 4.1.30.Fin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3488" }, "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x where SSLv2Hello messages requiring large buffers (>30KB) caused infinite loops on BUFFER_OVERFLOW. Netty 4.1.39.Final is not vulnerable because commit fbe0e3506e (Oct 2017, Scott Mitchell/Apple) added a defense that detects two consecutive BUFFER_OVERFLOW events with no progress and throws an exception to break the loop. This fix was in upstream Netty 4.1.30.Fin..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-11-03T12:43:54.437566+00:00", "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target repository is at version 4.1.39.Final, which already contains the upstream fix. The vulnerability (infinite loop in OpenSslEngine when SSL_write returns SSL_ERROR_WANT_READ/WANT_WRITE with no BIO buffer data) was fixed in upstream commit 9e2c400f89 by Scott Mitchell, first released in Netty 4.1.1.Final (May 2016). This fix was already present when TuxCare onboarded version 4.1.39.Final. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4970" }, "impact_statement": "CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target repository is at version 4.1.39.Final, which already contains the upstream fix. The vulnerability (infinite loop in OpenSslEngine when SSL_write returns SSL_ERROR_WANT_READ/WANT_WRITE with no BIO buffer data) was fixed in upstream commit 9e2c400f89 by Scott Mitchell, first released in Netty 4.1.1.Final (May 2016). This fix was already present when TuxCare onboarded version 4.1.39.Final. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 affects Netty's fragmented TLS handshake support, which allows allocation of up to 16MB per connection without validation. Version 4.1.39.Final (released August 13, 2019) is NOT AFFECTED because the vulnerable code was introduced later. The fragmented handshake support that enables multi-record ClientHello buffering was added in commit 29c471ec52 on November 29, 2019\u2014over 3 month...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 CVE-2023-34462 affects Netty's fragmented TLS handshake support, which allows allocation of up to 16MB per connection without validation. Version 4.1.39.Final (released August 13, 2019) is NOT AFFECTED because the vulnerable code was introduced later. The fragmented handshake support that enables multi-record ClientHello buffering was added in commit 29c471ec52 on November 29, 2019\u2014over 3 month..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.39.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-11-04T08:08:20.959393+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.39.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.39.Final-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler. Version 4.1.39.Final does not contain the vulnerable code described in CVE-2026-44249. The CVE specifically targets the IpSubnetFilterRule.compareTo(InetSocketAddress) method which performs bitwise AND using networkAddress instead of subnetMask. This compareTo method does not exist in 4.1.39.Final - it was added later in commit 303f2722f8 (Feb 2024) and first appeared in versions 4.1.108+. TuxCare backported the fix down to 4.1.52.Final but not to 4.1.39.Final because the vulnerable method is not present in that older version. The existing matches() method in 4.1.39.Final correctly uses subnetMask in its bitwise AND operation (line 156).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44249" }, "impact_statement": "Version 4.1.39.Final does not contain the vulnerable code described in CVE-2026-44249. The CVE specifically targets the IpSubnetFilterRule.compareTo(InetSocketAddress) method which performs bitwise AND using networkAddress instead of subnetMask. This compareTo method does not exist in 4.1.39.Final - it was added later in commit 303f2722f8 (Feb 2024) and first appeared in versions 4.1.108+. TuxCare backported the fix down to 4.1.52.Final but not to 4.1.39.Final because the vulnerable method is not present in that older version. The existing matches() method in 4.1.39.Final correctly uses subnetMask in its bitwise AND operation (line 156)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler. Version 4.1.39.Final is NOT AFFECTED by CVE-2026-45416. The vulnerable class SslClientHelloHandler does not exist in this version (introduced February 2020, after 4.1.39.Final's June 2019 release). The CVE describes a specific vulnerability where SslClientHelloHandler.decode() reads a 24-bit TLS handshake length and eagerly allocates ctx.alloc().buffer(handshakeLength), causing huge unpooled allocations when maxClientHelloLength=0 disables the guard. In version 4.1.39.Final, AbstractSniHandler handles TLS ClientHello parsing but uses a fundamentally different architecture: it processes ClientHello messages inline from the input ByteBuf without reading the 24-bit handshake length field or performing eager buffer allocation. The attack chain from INPUT (TLS ClientHello with large declared length) to GOAL (excessive memory allocation) is broken because the dangerous operation (eager allocation based on handshake length) does not exist in this version's code. Type A2 applies: INPUT is received but no path reaches the GOAL due to the missing implementation of the vulnerable mechanism.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Version 4.1.39.Final is NOT AFFECTED by CVE-2026-45416. The vulnerable class SslClientHelloHandler does not exist in this version (introduced February 2020, after 4.1.39.Final's June 2019 release). The CVE describes a specific vulnerability where SslClientHelloHandler.decode() reads a 24-bit TLS handshake length and eagerly allocates ctx.alloc().buffer(handshakeLength), causing huge unpooled allocations when maxClientHelloLength=0 disables the guard. In version 4.1.39.Final, AbstractSniHandler handles TLS ClientHello parsing but uses a fundamentally different architecture: it processes ClientHello messages inline from the input ByteBuf without reading the 24-bit handshake length field or performing eager buffer allocation. The attack chain from INPUT (TLS ClientHello with large declared length) to GOAL (excessive memory allocation) is broken because the dangerous operation (eager allocation based on handshake length) does not exist in this version's code. Type A2 applies: INPUT is received but no path reaches the GOAL due to the missing implementation of the vulnerable mechanism." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler. Netty 4.1.39.Final is not affected by CVE-2026-75596. The vulnerability exists in SslClientHelloHandler, a class that was introduced in version 4.1.46.Final (February 2020), well after the 4.1.39.Final release. The target version uses AbstractSniHandler with a different architecture that assumes ClientHello messages fit within a single TLS record and does not perform fragment aggregation. Therefore, the quadratic buffer recopying vulnerability pattern described in the CVE does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "Netty 4.1.39.Final is not affected by CVE-2026-75596. The vulnerability exists in SslClientHelloHandler, a class that was introduced in version 4.1.46.Final (February 2020), well after the 4.1.39.Final release. The target version uses AbstractSniHandler with a different architecture that assumes ClientHello messages fit within a single TLS record and does not perform fragment aggregation. Therefore, the quadratic buffer recopying vulnerability pattern described in the CVE does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.39.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:18:51.285671+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" }, "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.39.Final-tuxcare.1 of io.netty:netty-handler." } ] }