{
  "@id": "urn:uuid:9ccf4c10-3501-41ff-b6f0-da07982c3196",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:08:50.550389+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty before 3.9.2 where crafted SSLv2Hello messages cause infinite loops due to fixed-size buffer pools. Netty 4.1.58.Final is NOT affected because it uses dynamic ByteBuf allocation. The vulnerable pattern (fixed buffer pool causing infinite BUFFER_OVERFLOW loop) does not exist in 4.x architecture. When BUFFER_OVERFLOW occurs, the code allocates new buffers sized to engi...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty before 3.9.2 where crafted SSLv2Hello messages cause infinite loops due to fixed-size buffer pools. Netty 4.1.58.Final is NOT affected because it uses dynamic ByteBuf allocation. The vulnerable pattern (fixed buffer pool causing infinite BUFFER_OVERFLOW loop) does not exist in 4.x architecture. When BUFFER_OVERFLOW occurs, the code allocates new buffers sized to engi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:37:16.972133+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler. CVE-2016-4970 is not present in the target. The vulnerability was an infinite loop in OpenSslEngine when SSL_write returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer. The upstream Netty project fixed this in version 4.1.1.Final (May 2016, commit 9e2c400f89) by returning to the event loop instead of continuing the loop. The target version 4.1.58.Final already contains this upstream fix, as confirmed by git history analysis showing the fix commit is an ancestor of the TuxCare setup commit. The current code in ReferenceCountedOpenSslEngine.java:922-945 correctly returns from the method on both error conditions, preventing the infinite loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 is not present in the target. The vulnerability was an infinite loop in OpenSslEngine when SSL_write returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer. The upstream Netty project fixed this in version 4.1.1.Final (May 2016, commit 9e2c400f89) by returning to the event loop instead of continuing the loop. The target version 4.1.58.Final already contains this upstream fix, as confirmed by git history analysis showing the fix commit is an ancestor of the TuxCare setup commit. The current code in ReferenceCountedOpenSslEngine.java:922-945 correctly returns from the method on both error conditions, preventing the infinite loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler. CVE-2020-11612 affects Netty 4.1.x before 4.1.46 with unbounded memory allocation in ZlibDecoders. The target version is 4.1.58.Final-tuxcare.2, which already contains the upstream fix introduced in netty-4.1.46.Final (commit 1543218d3e, Jan 2020). The fix adds a configurable maxAllocation parameter to ZlibDecoder and its subclasses, enforcing buffer size limits via the prepareDecompressBuffer() method. This fix was authored by Rich.DiCroce@scientificgames.com and shipped in the upstream release before TuxCare onboarded version 4.1.58.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 affects Netty 4.1.x before 4.1.46 with unbounded memory allocation in ZlibDecoders. The target version is 4.1.58.Final-tuxcare.2, which already contains the upstream fix introduced in netty-4.1.46.Final (commit 1543218d3e, Jan 2020). The fix adds a configurable maxAllocation parameter to ZlibDecoder and its subclasses, enforcing buffer size limits via the prepareDecompressBuffer() method. This fix was authored by Rich.DiCroce@scientificgames.com and shipped in the upstream release before TuxCare onboarded version 4.1.58.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T03:28:09.355486+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.58.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "action_statement": "Vulnerability CVE-2026-45416 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.58.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.58.Final-tuxcare.2 of io.netty:netty-handler."
    }
  ]
}