{
  "@id": "urn:uuid:04c11879-38a9-49a1-879d-7b7a026cc129",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T06:30:59.615940+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x (org.jboss.netty package) where SSLv2Hello messages cause infinite BUFFER_OVERFLOW loops. The target is Netty 4.x (io.netty package) version 4.1.48.Final, which has a different architecture and includes upstream protection against infinite BUFFER_OVERFLOW loops. Commit fbe0e3506e7 (Scott Mitchell, 2017-10-30) added detection for consecutive overflows without data...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x (org.jboss.netty package) where SSLv2Hello messages cause infinite BUFFER_OVERFLOW loops. The target is Netty 4.x (io.netty package) version 4.1.48.Final, which has a different architecture and includes upstream protection against infinite BUFFER_OVERFLOW loops. Commit fbe0e3506e7 (Scott Mitchell, 2017-10-30) added detection for consecutive overflows without data..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T06:30:59.615940+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler. CVE-2016-4970 infinite loop vulnerability in OpenSslEngine was fixed in upstream Netty 4.1.1.Final by commit 9e2c400f89 (authored by scott_mitchell@apple.com). The target version 4.1.48.Final already contains this upstream fix. The vulnerable pattern (continuing the loop when SSL_ERROR_WANT_READ occurs with no BIO data) is not present; the current code immediately returns NEED_UNWRAP, preventing the infinite loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 infinite loop vulnerability in OpenSslEngine was fixed in upstream Netty 4.1.1.Final by commit 9e2c400f89 (authored by scott_mitchell@apple.com). The target version 4.1.48.Final already contains this upstream fix. The vulnerable pattern (continuing the loop when SSL_ERROR_WANT_READ occurs with no BIO data) is not present; the current code immediately returns NEED_UNWRAP, preventing the infinite loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T06:30:59.615940+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler. CVE-2020-11612 affects Netty 4.1.x before 4.1.46, involving unbounded memory allocation in ZlibDecoders during decompression. The target repository (Netty 4.1.48.Final-tuxcare.5) is NOT AFFECTED because the fix was already present in the upstream Netty 4.1.48.Final release. The defense code (maxAllocation parameter and prepareDecompressBuffer() method) was introduced in upstream commit 1543218d3e by Rich DiCroce from scientificgames.com. This commit is an ancestor of the first TuxCare commit (7ccf2196da \"Tuxcare setup for Netty 4.1.48.Final\"), confirming the fix shipped in the upstream release that TuxCare onboarded. All three decoder classes (ZlibDecoder, JZlibDecoder, JdkZlibDecoder) properly implement the buffer size limiting mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 affects Netty 4.1.x before 4.1.46, involving unbounded memory allocation in ZlibDecoders during decompression. The target repository (Netty 4.1.48.Final-tuxcare.5) is NOT AFFECTED because the fix was already present in the upstream Netty 4.1.48.Final release. The defense code (maxAllocation parameter and prepareDecompressBuffer() method) was introduced in upstream commit 1543218d3e by Rich DiCroce from scientificgames.com. This commit is an ancestor of the first TuxCare commit (7ccf2196da \"Tuxcare setup for Netty 4.1.48.Final\"), confirming the fix shipped in the upstream release that TuxCare onboarded. All three decoder classes (ZlibDecoder, JZlibDecoder, JdkZlibDecoder) properly implement the buffer size limiting mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T06:30:59.615940+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T06:30:59.615940+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T06:30:59.615940+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.48.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T06:30:59.615940+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T06:30:59.615940+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler. not_affected \u2014 CVE-2026-44249 describes a vulnerability in the IpSubnetFilterRule.compareTo() method introduced by a binary search optimization in September 2020. The target version 4.1.48.Final predates this optimization and does not contain the vulnerable code path. The target uses a simpler matches() method that correctly applies the subnet mask in bitwise AND operations, preventing the bypass described in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-44249 describes a vulnerability in the IpSubnetFilterRule.compareTo() method introduced by a binary search optimization in September 2020. The target version 4.1.48.Final predates this optimization and does not contain the vulnerable code path. The target uses a simpler matches() method that correctly applies the subnet mask in bitwise AND operations, preventing the bypass described in..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T06:32:00.049775+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T06:30:59.615940+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T06:30:59.615940+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T06:30:59.615940+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T06:30:59.615940+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.48.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T06:30:59.615940+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.48.Final-tuxcare.6 of io.netty:netty-handler."
    }
  ]
}