{
  "@id": "urn:uuid:e99b3562-3dc0-4cb5-ade7-f8921a5ba079",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T18:51:49.799753+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects only Netty 3.x (package org.jboss.netty). The target is Netty 4.1.74.Final (package io.netty), a complete architectural rewrite released in 2013. Netty 4.x was designed from its initial release (4.0.0.Alpha1) with proper BUFFER_OVERFLOW handling in the unwrap() method that prevents the infinite loop vulnerability. The vulnerable code pattern from Netty 3.x never existed in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects only Netty 3.x (package org.jboss.netty). The target is Netty 4.1.74.Final (package io.netty), a complete architectural rewrite released in 2013. Netty 4.x was designed from its initial release (4.0.0.Alpha1) with proper BUFFER_OVERFLOW handling in the unwrap() method that prevents the infinite loop vulnerability. The vulnerable code pattern from Netty 3.x never existed in..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler. CVE-2016-4970 affects Netty versions before 4.0.37.Final and 4.1.1.Final. The target (4.1.74.Final) contains the upstream fix in ReferenceCountedOpenSslEngine.java lines 967-990, where both SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE cases explicitly return control to the event loop, preventing the infinite loop vulnerability. The fix was introduced in upstream commit cd3bf3df58c (2017-02-05) and shipped in the upstream 4.1.74.Final release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty versions before 4.0.37.Final and 4.1.1.Final. The target (4.1.74.Final) contains the upstream fix in ReferenceCountedOpenSslEngine.java lines 967-990, where both SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE cases explicitly return control to the event loop, preventing the infinite loop vulnerability. The fix was introduced in upstream commit cd3bf3df58c (2017-02-05) and shipped in the upstream 4.1.74.Final release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler. CVE-2020-11612 describes unbounded memory allocation in ZlibDecoders in Netty 4.1.x before 4.1.46. The target repository is Netty version 4.1.74.Final-tuxcare.1, which already contains the upstream fix. The fix (commit 1543218d3e7afcb33a90b728b14370395a3deca0) was authored by Rich DiCroce and shipped in the upstream release 4.1.74.Final before TuxCare onboarded the code. The vulnerable pattern (unbounded decompression buffer allocation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 describes unbounded memory allocation in ZlibDecoders in Netty 4.1.x before 4.1.46. The target repository is Netty version 4.1.74.Final-tuxcare.1, which already contains the upstream fix. The fix (commit 1543218d3e7afcb33a90b728b14370395a3deca0) was authored by Rich DiCroce and shipped in the upstream release 4.1.74.Final before TuxCare onboarded the code. The vulnerable pattern (unbounded decompression buffer allocation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.74.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.74.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.74.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-13T18:51:49.799753+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.74.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.74.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.74.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T09:13:20.704692+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.74.Final-tuxcare.3 of io.netty:netty-handler."
    }
  ]
}