{
  "@id": "urn:uuid:570a8e14-1352-4c6f-8055-d5605faa8a42",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 23,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T09:47:00.050250+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T18:02:36.547436+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 describes an infinite loop DoS in Netty's SslHandler when processing SSLv2Hello messages requiring >30KB application buffers. The vulnerability existed in Netty 3.x versions before 3.9.2 due to repeated BUFFER_OVERFLOW returns when using undersized pooled buffers. Netty 4.1.92.Final is NOT affected: the upstream fix was introduced in commit 9660e2f6a9 (July 2015) by Norman Maurer,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 describes an infinite loop DoS in Netty's SslHandler when processing SSLv2Hello messages requiring >30KB application buffers. The vulnerability existed in Netty 3.x versions before 3.9.2 due to repeated BUFFER_OVERFLOW returns when using undersized pooled buffers. Netty 4.1.92.Final is NOT affected: the upstream fix was introduced in commit 9660e2f6a9 (July 2015) by Norman Maurer,..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:32:43.249791+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler. CVE-2016-4970 is not present in Netty 4.1.92.Final. The vulnerability was an infinite loop in OpenSslEngine.wrap() when SSL_write returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with no pending BIO data. The fix was already incorporated into the upstream release that TuxCare onboarded. The current code in ReferenceCountedOpenSslEngine.java (lines 985-1008) returns immediately to the event loop with NEED_UNWRAP or BUFFER_OVERFLOW status instead of continuing the loop, preventing the infinite loop condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 is not present in Netty 4.1.92.Final. The vulnerability was an infinite loop in OpenSslEngine.wrap() when SSL_write returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with no pending BIO data. The fix was already incorporated into the upstream release that TuxCare onboarded. The current code in ReferenceCountedOpenSslEngine.java (lines 985-1008) returns immediately to the event loop with NEED_UNWRAP or BUFFER_OVERFLOW status instead of continuing the loop, preventing the infinite loop condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler. Target Netty 4.1.92.Final contains the upstream fix for CVE-2020-11612 that was shipped in Netty 4.1.46.Final. The vulnerable pattern (unbounded memory allocation during Zlib decompression) is not present. The fix commit 1543218d3e7afcb33a90b728b14370395a3deca0 by Rich.DiCroce@scientificgames.com added a configurable maxAllocation parameter and prepareDecompressBuffer() method that enforces buffer size limits and throws DecompressionException when exceeded. This upstream fix was included in the base release before TuxCare onboarding (first TuxCare commit dcfa36507c).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "Target Netty 4.1.92.Final contains the upstream fix for CVE-2020-11612 that was shipped in Netty 4.1.46.Final. The vulnerable pattern (unbounded memory allocation during Zlib decompression) is not present. The fix commit 1543218d3e7afcb33a90b728b14370395a3deca0 by Rich.DiCroce@scientificgames.com added a configurable maxAllocation parameter and prepareDecompressBuffer() method that enforces buffer size limits and throws DecompressionException when exceeded. This upstream fix was included in the base release before TuxCare onboarding (first TuxCare commit dcfa36507c).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:32:00.049964+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.92.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.92.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.92.Final-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.92.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.92.Final-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-01T13:33:46.866683+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.92.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "action_statement": "Vulnerability CVE-2026-45416 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.92.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.92.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.92.Final-tuxcare.1 of io.netty:netty-handler."
    }
  ]
}