{ "@id": "urn:uuid:376d6c94-77e1-4710-a0be-e61e87780f06", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T09:48:00.052482+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty before 3.9.2 where SSLv2Hello messages cause infinite loops due to insufficient buffer allocation. The target (Netty 4.2.12.Final) contains an upstream fix from 2015 that handles BUFFER_OVERFLOW by dynamically allocating appropriately-sized buffers. The fix commit (9660e2f6a98 by Norman Maurer) was already present in the upstream release before TuxCare onboarding. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3488" }, "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty before 3.9.2 where SSLv2Hello messages cause infinite loops due to insufficient buffer allocation. The target (Netty 4.2.12.Final) contains an upstream fix from 2015 that handles BUFFER_OVERFLOW by dynamically allocating appropriately-sized buffers. The fix commit (9660e2f6a98 by Norman Maurer) was already present in the upstream release before TuxCare onboarding. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version 4.2.12.Final does not contain the vulnerable code pattern. Analysis of ReferenceCountedOpenSslEngine.java shows that the wrap() method properly handles SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE by returning control to the event loop (NEED_UNWRAP/BUFFER_OVERFLOW) rather than continuing the processing loop. The vulnerable pattern (using break; which causes an infinite loop when BIO buffer is empty) is not present in this version. This appears to be a case where the 4.2.x architecture was developed with proper error handling from the start, or the fix predates the 4.2.12.Final release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4970" }, "impact_statement": "CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version 4.2.12.Final does not contain the vulnerable code pattern. Analysis of ReferenceCountedOpenSslEngine.java shows that the wrap() method properly handles SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE by returning control to the event loop (NEED_UNWRAP/BUFFER_OVERFLOW) rather than continuing the processing loop. The vulnerable pattern (using break; which causes an infinite loop when BIO buffer is empty) is not present in this version. This appears to be a case where the 4.2.x architecture was developed with proper error handling from the start, or the fix predates the 4.2.12.Final release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2019-20445 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 4.2.12.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-p2v9-g2qv-p635 (affected up to 4.1.45), NVD (affected up to 4.1.44).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20445" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 4.2.12.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-p2v9-g2qv-p635 (affected up to 4.1.45), NVD (affected up to 4.1.44)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-handler. CVE-2020-11612 addresses unbounded memory allocation in Netty's ZlibDecoders. The target (Netty 4.2.12.Final) already contains the upstream fix (commit 1543218d) that introduced the maxAllocation mechanism. This fix was shipped in the upstream Netty release before TuxCare onboarded the version. The vulnerable pattern (lack of any buffer size limiting capability) is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11612" }, "impact_statement": "CVE-2020-11612 addresses unbounded memory allocation in Netty's ZlibDecoders. The target (Netty 4.2.12.Final) already contains the upstream fix (commit 1543218d) that introduced the maxAllocation mechanism. This fix was shipped in the upstream Netty release before TuxCare onboarded the version. The vulnerable pattern (lack of any buffer size limiting capability) is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-handler. CVE-2020-7238 is NOT present in this target. The vulnerability involves HTTP request smuggling via conflicting Transfer-Encoding: chunked and Content-Length headers. The fix (commit 8494b046ec by Norman Maurer, Dec 2019) was already included in upstream Netty 4.2.12.Final before TuxCare's onboarding (commit 90601c73, Sep 2026). The defense code at HttpObjectDecoder.java lines 849-853 detects this header combination for HTTP/1.1 requests and either rejects them (default) or removes the Content-Length header, preventing smuggling attacks. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-7238" }, "impact_statement": "CVE-2020-7238 is NOT present in this target. The vulnerability involves HTTP request smuggling via conflicting Transfer-Encoding: chunked and Content-Length headers. The fix (commit 8494b046ec by Norman Maurer, Dec 2019) was already included in upstream Netty 4.2.12.Final before TuxCare's onboarding (commit 90601c73, Sep 2026). The defense code at HttpObjectDecoder.java lines 849-853 detects this header combination for HTTP/1.1 requests and either rejects them (default) or removes the Content-Length header, preventing smuggling attacks. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 Target version 4.2.12.Final is NOT affected by CVE-2023-34462. The upstream vendor (Netty) fixed the unbounded heap allocation vulnerability in commit 535da17e45 (authored by Norman Maurer), which was already included in the upstream 4.2.12.Final release before TuxCare onboarded it. The target code contains the complete defense logic: validation checks in SslClientHelloHandler.java (lines 142-1...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Target version 4.2.12.Final is NOT affected by CVE-2023-34462. The upstream vendor (Netty) fixed the unbounded heap allocation vulnerability in commit 535da17e45 (authored by Norman Maurer), which was already included in the upstream 4.2.12.Final release before TuxCare onboarded it. The target code contains the complete defense logic: validation checks in SslClientHelloHandler.java (lines 142-1..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.2.12.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2025-24970 does not affect version 4.2.12.Final-tuxcare.2 of io.netty:netty-handler. CVE-2025-24970 fix is already present in target version 4.2.12.Final. The vulnerability concerned missing validation in SSL packet length parsing that could cause native crashes. All three fix components are present: (1) SslUtils.java validates buffer size before reading packet length and returns NOT_ENCRYPTED for invalid SSLv2 packets (lines 324-328, 360-361, 380-382, 451-454, 497-499), (2) ReferenceCountedOpenSslEngine.java asserts non-negative packet length (line 1229), and (3) SslHandler.java replaces assertion with explicit NotSslRecordException check (lines 1385-1389). These fixes were introduced by upstream commit 783179b21f8a46b461e6b56697ffcb47d0c48b38 (author: christianvest_hansen@apple.com) which is an ancestor of the 4.2.12.Final release that TuxCare onboarded. This is an upstream fix that shipped in the release before TuxCare maintenance began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.91.Final, < 4.1.118.Final), NVD (>= 4.1.91, < 4.1.118), cve.org (>= 4.1.91.Final, <= 4.1.117.Final), Snyk (>= 4.1.91.Final, < 4.1.118.Final; >= 4.2.0.Alpha1, < 4.2.0.RC3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24970" }, "impact_statement": "CVE-2025-24970 fix is already present in target version 4.2.12.Final. The vulnerability concerned missing validation in SSL packet length parsing that could cause native crashes. All three fix components are present: (1) SslUtils.java validates buffer size before reading packet length and returns NOT_ENCRYPTED for invalid SSLv2 packets (lines 324-328, 360-361, 380-382, 451-454, 497-499), (2) ReferenceCountedOpenSslEngine.java asserts non-negative packet length (line 1229), and (3) SslHandler.java replaces assertion with explicit NotSslRecordException check (lines 1385-1389). These fixes were introduced by upstream commit 783179b21f8a46b461e6b56697ffcb47d0c48b38 (author: christianvest_hansen@apple.com) which is an ancestor of the 4.2.12.Final release that TuxCare onboarded. This is an upstream fix that shipped in the release before TuxCare maintenance began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.91.Final, < 4.1.118.Final), NVD (>= 4.1.91, < 4.1.118), cve.org (>= 4.1.91.Final, <= 4.1.117.Final), Snyk (>= 4.1.91.Final, < 4.1.118.Final; >= 4.2.0.Alpha1, < 4.2.0.RC3)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.2.12.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-44249" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.2.12.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-45416" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.2.12.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-50010" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-09T14:20:07.636772+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.12.Final-tuxcare.2" } } ], "timestamp": "2026-11-12T09:48:00.052482+00:00", "status_notes": "Vulnerability CVE-2026-75596 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-handler, and is fixed in 4.2.12.Final-tuxcare.4.", "vulnerability": { "name": "CVE-2026-75596" }, "action_statement": "Vulnerability CVE-2026-75596 affects version 4.2.12.Final-tuxcare.2 of io.netty:netty-handler, and is fixed in 4.2.12.Final-tuxcare.4." } ] }