{
  "@id": "urn:uuid:1af93941-dcdf-4497-9ee8-49eb4822f316",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T05:43:01.502758+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affected Netty 3.x (before 3.9.2) where SSLv2Hello messages requiring >30KB buffers caused infinite loops due to repeated BUFFER_OVERFLOW with fixed-size pooled buffers. The target (Netty 4.1.76.Final) has a different architecture with runtime defense: when BUFFER_OVERFLOW occurs during SSL unwrap, the code dynamically allocates a buffer sized to engine.getSession().getApplication...",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affected Netty 3.x (before 3.9.2) where SSLv2Hello messages requiring >30KB buffers caused infinite loops due to repeated BUFFER_OVERFLOW with fixed-size pooled buffers. The target (Netty 4.1.76.Final) has a different architecture with runtime defense: when BUFFER_OVERFLOW occurs during SSL unwrap, the code dynamically allocates a buffer sized to engine.getSession().getApplication..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler. CVE-2016-4970 (infinite loop in OpenSslEngine due to improper handling of SSL_ERROR_WANT_READ/WANT_WRITE) is not present in Netty 4.1.76.Final. The target contains the upstream fix that was released in Netty 4.1.1.Final (2016). The fix properly handles SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE by returning control to the event loop (NEED_UNWRAP) instead of continuing to loop when the BIO buffer is empty, preventing the infinite loop DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 (infinite loop in OpenSslEngine due to improper handling of SSL_ERROR_WANT_READ/WANT_WRITE) is not present in Netty 4.1.76.Final. The target contains the upstream fix that was released in Netty 4.1.1.Final (2016). The fix properly handles SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE by returning control to the event loop (NEED_UNWRAP) instead of continuing to loop when the BIO buffer is empty, preventing the infinite loop DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler. CVE-2020-11612 is not present in Netty 4.1.76.Final. The vulnerability (unbounded memory allocation during zlib decompression) was fixed in upstream Netty 4.1.46.Final via commit 1543218d3e (January 2020). This fix was already present when TuxCare onboarded version 4.1.76.Final in October 2026. The fix adds an optional maxAllocation parameter to ZlibDecoder and its subclasses (JZlibDecoder, JdkZlibDecoder) that limits decompression buffer size and throws DecompressionException when the limit is reached, preventing memory exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 is not present in Netty 4.1.76.Final. The vulnerability (unbounded memory allocation during zlib decompression) was fixed in upstream Netty 4.1.46.Final via commit 1543218d3e (January 2020). This fix was already present when TuxCare onboarded version 4.1.76.Final in October 2026. The fix adds an optional maxAllocation parameter to ZlibDecoder and its subclasses (JZlibDecoder, JdkZlibDecoder) that limits decompression buffer size and throws DecompressionException when the limit is reached, preventing memory exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.76.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.76.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "action_statement": "Vulnerability CVE-2023-34462 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.76.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.76.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-11T05:43:01.502758+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.76.Final-tuxcare.3 of io.netty:netty-handler."
    }
  ]
}