{
  "@id": "urn:uuid:080af194-95ac-48f7-bbdc-f39365097092",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler. not_affected \u2014 Target Netty 4.1.96.Final is not affected by CVE-2014-3488. The vulnerability (infinite loop when processing SSLv2Hello messages requiring large buffers) was fixed in upstream Netty 4.x by commit 9660e2f6a9 (authored by Norman Maurer, 2015-07-07), which introduced BUFFER_OVERFLOW handling that dynamically allocates larger buffers. This fix was already present in the upstream release that TuxCar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 Target Netty 4.1.96.Final is not affected by CVE-2014-3488. The vulnerability (infinite loop when processing SSLv2Hello messages requiring large buffers) was fixed in upstream Netty 4.x by commit 9660e2f6a9 (authored by Norman Maurer, 2015-07-07), which introduced BUFFER_OVERFLOW handling that dynamically allocates larger buffers. This fix was already present in the upstream release that TuxCar..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final, causing an infinite loop in OpenSslEngine when SSL_write returns SSL_ERROR_WANT_READ/WANT_WRITE with an empty BIO buffer. The target (4.1.96.Final) contains the upstream fix: when these error codes occur, the code now returns to the event loop (lines 986-1009 in ReferenceCountedOpenSslEngine.java) instead of continuing to loop indefinitely. The fix was introduced in commit cd3bf3df58c by upstream Netty developer Scott Mitchell and shipped in the upstream 4.1.96.Final release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final, causing an infinite loop in OpenSslEngine when SSL_write returns SSL_ERROR_WANT_READ/WANT_WRITE with an empty BIO buffer. The target (4.1.96.Final) contains the upstream fix: when these error codes occur, the code now returns to the event loop (lines 986-1009 in ReferenceCountedOpenSslEngine.java) instead of continuing to loop indefinitely. The fix was introduced in commit cd3bf3df58c by upstream Netty developer Scott Mitchell and shipped in the upstream 4.1.96.Final release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler. CVE-2020-11612 affects Netty 4.1.x before 4.1.46. The target is version 4.1.96.Final, which includes the upstream vendor fix (commit 1543218d3e) that added maxAllocation capability to ZlibDecoder classes. The defense mechanism exists in the code but is disabled by default (maxAllocation=0 means unlimited). The fix was authored by Rich DiCroce (Scientific Games) and shipped in the upstream 4.1.46.Final release, which TuxCare later onboarded as 4.1.96.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 affects Netty 4.1.x before 4.1.46. The target is version 4.1.96.Final, which includes the upstream vendor fix (commit 1543218d3e) that added maxAllocation capability to ZlibDecoder classes. The defense mechanism exists in the code but is disabled by default (maxAllocation=0 means unlimited). The fix was authored by Rich DiCroce (Scientific Games) and shipped in the upstream 4.1.46.Final release, which TuxCare later onboarded as 4.1.96.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 does not affect Netty 4.1.96.Final. The vulnerability (unbounded heap allocation up to 16MB during TLS ClientHello parsing) was fixed in upstream commit 535da17e452 by Norman Maurer on 2023-06-20. This fix was already present in the upstream Netty 4.1.96.Final release when TuxCare onboarded it on commit 64592af441. The target code includes maxClientHelloLength validation with a d...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34462 does not affect Netty 4.1.96.Final. The vulnerability (unbounded heap allocation up to 16MB during TLS ClientHello parsing) was fixed in upstream commit 535da17e452 by Norman Maurer on 2023-06-20. This fix was already present in the upstream Netty 4.1.96.Final release when TuxCare onboarded it on commit 64592af441. The target code includes maxClientHelloLength validation with a d..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.96.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.96.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:57:12.801902+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.96.Final-tuxcare.4 of io.netty:netty-handler."
    }
  ]
}