{
  "@id": "urn:uuid:9c4b72ed-b0a1-4009-b8ef-702ea29dcfbe",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 Netty 4.1.51.Final is not affected by CVE-2014-3488. The vulnerability was specific to Netty 3.x architecture (package org.jboss.netty) where an infinite loop could occur when processing SSLv2Hello messages requiring buffers larger than the pool size. Netty 4.x (package io.netty) has a fundamentally different architecture with built-in protection: it detects consecutive BUFFER_OVERFLOW events w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 Netty 4.1.51.Final is not affected by CVE-2014-3488. The vulnerability was specific to Netty 3.x architecture (package org.jboss.netty) where an infinite loop could occur when processing SSLv2Hello messages requiring buffers larger than the pool size. Netty 4.x (package io.netty) has a fundamentally different architecture with built-in protection: it detects consecutive BUFFER_OVERFLOW events w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler. CVE-2016-4970 is not present in Netty 4.1.51.Final. The vulnerability (infinite loop when SSL_write returns SSL_ERROR_WANT_READ with empty BIO buffer) was fixed in upstream Netty 4.1.1.Final (June 2016) by commit 9e2c400f89. The target version 4.1.51.Final was released in 2020 and includes this fix. The current code in ReferenceCountedOpenSslEngine.java line 921-925 returns immediately on SSL_ERROR_WANT_READ, preventing the infinite loop. The fix was already in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 is not present in Netty 4.1.51.Final. The vulnerability (infinite loop when SSL_write returns SSL_ERROR_WANT_READ with empty BIO buffer) was fixed in upstream Netty 4.1.1.Final (June 2016) by commit 9e2c400f89. The target version 4.1.51.Final was released in 2020 and includes this fix. The current code in ReferenceCountedOpenSslEngine.java line 921-925 returns immediately on SSL_ERROR_WANT_READ, preventing the infinite loop. The fix was already in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler. CVE-2020-11612 affects Netty 4.1.x before 4.1.46. The target is Netty 4.1.51.Final, which already contains the upstream fix (commit 1543218d3e, authored by Rich DiCroce on 2020-01-31). The fix adds maxAllocation parameter and prepareDecompressBuffer() method to ZlibDecoder and its subclasses, preventing unbounded memory allocation during decompression. This fix shipped in upstream Netty 4.1.46 (Feb 2020) and was already present when TuxCare onboarded version 4.1.51.Final in Aug 2025. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 affects Netty 4.1.x before 4.1.46. The target is Netty 4.1.51.Final, which already contains the upstream fix (commit 1543218d3e, authored by Rich DiCroce on 2020-01-31). The fix adds maxAllocation parameter and prepareDecompressBuffer() method to ZlibDecoder and its subclasses, preventing unbounded memory allocation during decompression. This fix shipped in upstream Netty 4.1.46 (Feb 2020) and was already present when TuxCare onboarded version 4.1.51.Final in Aug 2025. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.51.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.51.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T10:50:48.158635+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.51.Final-tuxcare.3 of io.netty:netty-handler."
    }
  ]
}