{
  "@id": "urn:uuid:11492561-d14a-470f-8c1d-f7e77b772294",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T21:23:24.194195+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T20:51:20.044630+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x (package org.jboss.netty) which used a fixed-size buffer pool. When an SSLv2Hello message was received, SSLEngine required >30KB buffer but the pool couldn't provide it, causing an infinite BUFFER_OVERFLOW loop. The target (Netty 4.1.59.Final) uses a completely different architecture (package io.netty) with dynamic buffer sizing present from Netty 4.0.0.Final (Ju...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x (package org.jboss.netty) which used a fixed-size buffer pool. When an SSLv2Hello message was received, SSLEngine required >30KB buffer but the pool couldn't provide it, causing an infinite BUFFER_OVERFLOW loop. The target (Netty 4.1.59.Final) uses a completely different architecture (package io.netty) with dynamic buffer sizing present from Netty 4.0.0.Final (Ju..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T20:51:20.044630+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler. CVE-2016-4970 does not affect Netty 4.1.59.Final. The vulnerability was fixed in upstream Netty 4.1.1.Final (released in 2016), and this fix is present in the target version 4.1.59.Final. The vulnerable code pattern (infinite loop when SSL_write returns WANT_READ/WANT_WRITE with empty BIO buffer) was removed by the upstream fix and is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 does not affect Netty 4.1.59.Final. The vulnerability was fixed in upstream Netty 4.1.1.Final (released in 2016), and this fix is present in the target version 4.1.59.Final. The vulnerable code pattern (infinite loop when SSL_write returns WANT_READ/WANT_WRITE with empty BIO buffer) was removed by the upstream fix and is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T20:51:20.044630+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T20:51:20.044630+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler. CVE-2020-11612 affects Netty 4.1.x before 4.1.46. The target repository (Netty 4.1.59.Final-tuxcare.1) contains the complete upstream fix that adds maxAllocation limit checking to ZlibDecoders via the prepareDecompressBuffer() method. The fix commit (1543218d3e7afcb33a90b728b14370395a3deca0) by Rich.DiCroce@scientificgames.com was already present in upstream Netty 4.1.59.Final when TuxCare onboarded it. The vulnerable pattern (unbounded memory allocation without limit checking) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 affects Netty 4.1.x before 4.1.46. The target repository (Netty 4.1.59.Final-tuxcare.1) contains the complete upstream fix that adds maxAllocation limit checking to ZlibDecoders via the prepareDecompressBuffer() method. The fix commit (1543218d3e7afcb33a90b728b14370395a3deca0) by Rich.DiCroce@scientificgames.com was already present in upstream Netty 4.1.59.Final when TuxCare onboarded it. The vulnerable pattern (unbounded memory allocation without limit checking) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T20:51:20.044630+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T20:51:20.044630+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 affects version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "action_statement": "Vulnerability CVE-2023-34462 affects version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T20:51:20.044630+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.59.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T20:51:20.044630+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      },
      "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T20:51:20.044630+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T20:51:20.044630+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T20:51:20.044630+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-13T21:23:24.194195+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.59.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.59.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.59.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T20:51:20.044630+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.59.Final-tuxcare.3 of io.netty:netty-handler."
    }
  ]
}