{
  "@id": "urn:uuid:63fb7c9e-d718-43e9-8db0-321c330fed50",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T18:03:31.602360+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affected Netty 3.x before 3.9.2, where SSLv2Hello messages caused infinite BUFFER_OVERFLOW loops due to inadequate buffer allocation. The target (Netty 4.1.63.Final) is not affected because it contains an upstream fix (commit fbe0e3506e7 by Scott Mitchell, 2017-10-30) that prevents infinite BUFFER_OVERFLOW loops through dynamic buffer allocation based on SSLEngine's requirements a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affected Netty 3.x before 3.9.2, where SSLv2Hello messages caused infinite BUFFER_OVERFLOW loops due to inadequate buffer allocation. The target (Netty 4.1.63.Final) is not affected because it contains an upstream fix (commit fbe0e3506e7 by Scott Mitchell, 2017-10-30) that prevents infinite BUFFER_OVERFLOW loops through dynamic buffer allocation based on SSLEngine's requirements a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:31:15.270922+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final. The target version is 4.1.63.Final, which is significantly newer. The vulnerability involved an infinite loop in OpenSslEngine.wrap() when SSL_write returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with no data in the BIO buffer. The fix (returning control to the event loop instead of continuing the loop) was introduced by upstream author Scott Mitchell in May-July 2016 and is present in the current code at ReferenceCountedOpenSslEngine.java lines 960-983. The fix was already in the upstream release when TuxCare onboarded version 4.1.63.Final in August 2025.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final. The target version is 4.1.63.Final, which is significantly newer. The vulnerability involved an infinite loop in OpenSslEngine.wrap() when SSL_write returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with no data in the BIO buffer. The fix (returning control to the event loop instead of continuing the loop) was introduced by upstream author Scott Mitchell in May-July 2016 and is present in the current code at ReferenceCountedOpenSslEngine.java lines 960-983. The fix was already in the upstream release when TuxCare onboarded version 4.1.63.Final in August 2025.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler. The target repository (Netty 4.1.63.Final) is NOT AFFECTED by CVE-2020-11612. The vulnerability was fixed in upstream Netty 4.1.46, and version 4.1.63.Final (released after 4.1.46) contains the complete fix. The fix adds a maxAllocation parameter to ZlibDecoder and its subclasses (JZlibDecoder, JdkZlibDecoder) that limits the decompression buffer size, preventing unbounded memory allocation. The fix commit 1543218d3e7afcb33a90b728b14370395a3deca0 by Rich DiCroce was already present in the upstream release when TuxCare onboarded 4.1.63.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "The target repository (Netty 4.1.63.Final) is NOT AFFECTED by CVE-2020-11612. The vulnerability was fixed in upstream Netty 4.1.46, and version 4.1.63.Final (released after 4.1.46) contains the complete fix. The fix adds a maxAllocation parameter to ZlibDecoder and its subclasses (JZlibDecoder, JdkZlibDecoder) that limits the decompression buffer size, preventing unbounded memory allocation. The fix commit 1543218d3e7afcb33a90b728b14370395a3deca0 by Rich DiCroce was already present in the upstream release when TuxCare onboarded 4.1.63.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T03:28:09.355486+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.63.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.63.Final-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.63.Final-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-29T13:19:07.423599+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.63.Final-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "action_statement": "Vulnerability CVE-2026-45416 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.63.Final-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.63.Final-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.63.Final-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.63.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.63.Final-tuxcare.4 of io.netty:netty-handler."
    }
  ]
}