{
  "@id": "urn:uuid:3e0d0048-aa8f-4302-b611-73b8d29e2136",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 20,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T18:00:13.639725+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 The target (Netty 4.1.73.Final-tuxcare.5) is not affected by CVE-2014-3488. While the CVE targets Netty 3.x (org.jboss.netty before 3.9.2), this is Netty 4.x (io.netty), which inherited comprehensive BUFFER_OVERFLOW handling from its 2012 architecture rewrite. The vulnerable pattern\u2014infinite loop when SSLv2Hello requires a buffer larger than available\u2014cannot occur because SslHandler.unwrap() ex...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 The target (Netty 4.1.73.Final-tuxcare.5) is not affected by CVE-2014-3488. While the CVE targets Netty 3.x (org.jboss.netty before 3.9.2), this is Netty 4.x (io.netty), which inherited comprehensive BUFFER_OVERFLOW handling from its 2012 architecture rewrite. The vulnerable pattern\u2014infinite loop when SSLv2Hello requires a buffer larger than available\u2014cannot occur because SslHandler.unwrap() ex..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:29:43.002778+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler. Target Netty 4.1.73.Final is not affected by CVE-2016-4970. The vulnerability was fixed in upstream Netty 4.1.1.Final (May 2016), and the target version (released much later) contains the fix. The vulnerable infinite loop pattern in SSL_ERROR_WANT_READ/WANT_WRITE handling is not present; the code properly returns to the event loop instead of continuing to loop. Although the original fix was in OpenSslEngine.java (commit 524156f by Scott Mitchell), the target has refactored code in ReferenceCountedOpenSslEngine.java that preserves the fix logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "Target Netty 4.1.73.Final is not affected by CVE-2016-4970. The vulnerability was fixed in upstream Netty 4.1.1.Final (May 2016), and the target version (released much later) contains the fix. The vulnerable infinite loop pattern in SSL_ERROR_WANT_READ/WANT_WRITE handling is not present; the code properly returns to the event loop instead of continuing to loop. Although the original fix was in OpenSslEngine.java (commit 524156f by Scott Mitchell), the target has refactored code in ReferenceCountedOpenSslEngine.java that preserves the fix logic.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler. CVE-2020-11612 is not present in Netty 4.1.73.Final. The vulnerability was fixed in upstream Netty 4.1.46 (January 2020) by adding a maxAllocation parameter to ZlibDecoder classes to limit decompression buffer size and prevent unbounded memory allocation. The target version 4.1.73.Final was released after 4.1.46 and already contains this fix in the upstream release that TuxCare onboarded. The fix commit (1543218d3e) by Rich DiCroce from Scientific Games is present in the codebase and predates all TuxCare maintenance commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 is not present in Netty 4.1.73.Final. The vulnerability was fixed in upstream Netty 4.1.46 (January 2020) by adding a maxAllocation parameter to ZlibDecoder classes to limit decompression buffer size and prevent unbounded memory allocation. The target version 4.1.73.Final was released after 4.1.46 and already contains this fix in the upstream release that TuxCare onboarded. The fix commit (1543218d3e) by Rich DiCroce from Scientific Games is present in the codebase and predates all TuxCare maintenance commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:30:00.096687+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.73.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.73.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "action_statement": "Vulnerability CVE-2023-34462 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.73.Final-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-29T16:13:11.255036+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.73.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.73.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-29T16:13:11.255036+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.73.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "action_statement": "Vulnerability CVE-2026-45416 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.73.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-29T16:13:11.255036+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.73.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.73.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.73.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.73.Final-tuxcare.1 of io.netty:netty-handler."
    }
  ]
}