{
  "@id": "urn:uuid:f06311a4-0959-466b-9308-a52e0ca1443b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T20:33:00.049075+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T08:06:49.626217+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 describes an infinite loop vulnerability in Netty 3.x where SSLv2Hello messages cause repeated BUFFER_OVERFLOW returns in the unwrap loop. The target (Netty 4.1.64.Final) is not affected because the upstream release already contains the necessary defense: when BUFFER_OVERFLOW occurs, the code dynamically allocates a buffer sized according to engine.getSession().getApplicationBuffe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 describes an infinite loop vulnerability in Netty 3.x where SSLv2Hello messages cause repeated BUFFER_OVERFLOW returns in the unwrap loop. The target (Netty 4.1.64.Final) is not affected because the upstream release already contains the necessary defense: when BUFFER_OVERFLOW occurs, the code dynamically allocates a buffer sized according to engine.getSession().getApplicationBuffe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T08:06:49.626217+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler. CVE-2016-4970 affects Netty versions before 4.0.37.Final and 4.1.1.Final. The target is running 4.1.64.Final, which includes the upstream fix committed by Scott Mitchell in May 2016 (commit 524156f164). The vulnerable infinite-loop pattern in OpenSslEngine.wrap() has been fixed: SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE now return immediately instead of continuing to loop when the BIO buffer is empty. This fix was part of the upstream 4.1.1.Final release and is present in all subsequent versions including 4.1.64.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty versions before 4.0.37.Final and 4.1.1.Final. The target is running 4.1.64.Final, which includes the upstream fix committed by Scott Mitchell in May 2016 (commit 524156f164). The vulnerable infinite-loop pattern in OpenSslEngine.wrap() has been fixed: SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE now return immediately instead of continuing to loop when the BIO buffer is empty. This fix was part of the upstream 4.1.1.Final release and is present in all subsequent versions including 4.1.64.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T08:06:49.626217+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T08:06:49.626217+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler. CVE-2020-11612 affects Netty 4.1.x before 4.1.46, allowing unbounded memory allocation during Zlib decompression. The target repository (Netty 4.1.64.Final) contains the upstream fix (commit 1543218d3e7afcb33a90b728b14370395a3deca0 by Rich.DiCroce@scientificgames.com) that was shipped in the upstream release before TuxCare onboarded version 4.1.64.Final. The fix adds a configurable maxAllocation parameter to ZlibDecoder, JZlibDecoder, and JdkZlibDecoder classes, with prepareDecompressBuffer() method enforcing buffer size limits and throwing DecompressionException when exceeded. The vulnerable code pattern (unbounded allocation without any limiting mechanism) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 affects Netty 4.1.x before 4.1.46, allowing unbounded memory allocation during Zlib decompression. The target repository (Netty 4.1.64.Final) contains the upstream fix (commit 1543218d3e7afcb33a90b728b14370395a3deca0 by Rich.DiCroce@scientificgames.com) that was shipped in the upstream release before TuxCare onboarded version 4.1.64.Final. The fix adds a configurable maxAllocation parameter to ZlibDecoder, JZlibDecoder, and JdkZlibDecoder classes, with prepareDecompressBuffer() method enforcing buffer size limits and throwing DecompressionException when exceeded. The vulnerable code pattern (unbounded allocation without any limiting mechanism) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T08:06:49.626217+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:33:00.049075+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 affects version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.64.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "action_statement": "Vulnerability CVE-2023-34462 affects version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.64.Final-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T08:06:49.626217+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.64.Final-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T08:08:00.111987+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T08:08:00.111987+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T08:08:00.111987+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T08:08:00.111987+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T08:06:49.626217+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T08:06:49.626217+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T08:06:49.626217+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.64.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T08:06:49.626217+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.64.Final-tuxcare.1 of io.netty:netty-handler."
    }
  ]
}