{
  "@id": "urn:uuid:202b1822-52d6-4608-9d65-9d3f796abd29",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T19:51:24.435252+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T18:05:20.953950+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affected Netty 3.x (before 3.9.2) due to a SslBufferPool implementation that used fixed-size buffers, causing infinite loops when SSLv2Hello messages required >30KB buffers. The target (Netty 4.1.99.Final) uses a completely different architecture with ByteBufAllocator and dynamic buffer allocation. When BUFFER_OVERFLOW occurs, Netty 4.x's SslHandler (lines 1478-1489) allocates a n...",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affected Netty 3.x (before 3.9.2) due to a SslBufferPool implementation that used fixed-size buffers, causing infinite loops when SSLv2Hello messages required >30KB buffers. The target (Netty 4.1.99.Final) uses a completely different architecture with ByteBufAllocator and dynamic buffer allocation. When BUFFER_OVERFLOW occurs, Netty 4.x's SslHandler (lines 1478-1489) allocates a n..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:30:34.591989+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler. CVE-2016-4970 is NOT present in target version 4.1.99.Final. The vulnerability (infinite loop in OpenSslEngine when SSL_write returns SSL_ERROR_WANT_READ/WANT_WRITE with empty BIO buffer) was fixed in upstream commit 9e2c400f89 by Scott Mitchell, which shipped in upstream release 4.1.1.Final. The target version 4.1.99.Final includes this upstream fix. The vulnerable pattern (breaking to continue the loop) has been replaced with proper return statements that exit the method with appropriate SSLEngineResult status codes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 is NOT present in target version 4.1.99.Final. The vulnerability (infinite loop in OpenSslEngine when SSL_write returns SSL_ERROR_WANT_READ/WANT_WRITE with empty BIO buffer) was fixed in upstream commit 9e2c400f89 by Scott Mitchell, which shipped in upstream release 4.1.1.Final. The target version 4.1.99.Final includes this upstream fix. The vulnerable pattern (breaking to continue the loop) has been replaced with proper return statements that exit the method with appropriate SSLEngineResult status codes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler. The target repository (Netty 4.1.99.Final-tuxcare.2) is not affected by CVE-2020-11612. The vulnerability concerning unbounded memory allocation in ZlibDecoders was fixed in the upstream Netty release that TuxCare onboarded. The fix commit 1543218d3e (authored by Rich DiCroce from Scientific Games) introduced the maxAllocation mechanism to ZlibDecoder, JZlibDecoder, and JdkZlibDecoder classes. This mechanism limits the decompression buffer size via the prepareDecompressBuffer() method, which throws a DecompressionException when the configured limit is exceeded. The fix was already present in Netty 4.1.99.Final before TuxCare's onboarding commit (25291a65a8), making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "The target repository (Netty 4.1.99.Final-tuxcare.2) is not affected by CVE-2020-11612. The vulnerability concerning unbounded memory allocation in ZlibDecoders was fixed in the upstream Netty release that TuxCare onboarded. The fix commit 1543218d3e (authored by Rich DiCroce from Scientific Games) introduced the maxAllocation mechanism to ZlibDecoder, JZlibDecoder, and JdkZlibDecoder classes. This mechanism limits the decompression buffer size via the prepareDecompressBuffer() method, which throws a DecompressionException when the configured limit is exceeded. The fix was already present in Netty 4.1.99.Final before TuxCare's onboarding commit (25291a65a8), making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T14:19:33.092775+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler. The upstream fix was released in 4.1.45, and version 4.1.99.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "The upstream fix was released in 4.1.45, and version 4.1.99.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 affects version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "action_statement": "Vulnerability CVE-2023-34462 affects version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.99.Final-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T12:12:03.413940+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T12:12:03.413940+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T12:12:03.413940+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T12:12:03.413940+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-13T19:51:24.435252+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.99.Final-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.99.Final-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T11:50:17.282407+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T11:50:17.282407+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.99.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T11:50:17.282407+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.99.Final-tuxcare.1 of io.netty:netty-handler."
    }
  ]
}