{
  "@id": "urn:uuid:88dfa41c-bb63-4078-8bd6-b663513ba500",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T08:29:38.625114+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:50:05.608703+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 describes an infinite loop vulnerability in Netty 3.x SslHandler when processing SSLv2Hello messages that require large application buffers (>30KB). The target is Netty 4.1.100.Final-tuxcare.2, which already contains an upstream fix for this vulnerability class. The fix (commit 9660e2f6a9, July 2015 by Norman Maurer) was present in the upstream release when TuxCare onboarded versi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 describes an infinite loop vulnerability in Netty 3.x SslHandler when processing SSLv2Hello messages that require large application buffers (>30KB). The target is Netty 4.1.100.Final-tuxcare.2, which already contains an upstream fix for this vulnerability class. The fix (commit 9660e2f6a9, July 2015 by Norman Maurer) was present in the upstream release when TuxCare onboarded versi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:50:05.608703+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler. CVE-2016-4970 affects Netty versions before 4.1.1.Final. The target version 4.1.100.Final includes the upstream fix (commit 9e2c400f89) which was shipped in Netty 4.1.1.Final (May 2016). The vulnerable infinite loop pattern in SSL_ERROR_WANT_READ/WANT_WRITE handling is not present in the target. The fix is in ReferenceCountedOpenSslEngine.java lines 1001-1024, where both error cases now return immediately instead of using break statements that would cause infinite looping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty versions before 4.1.1.Final. The target version 4.1.100.Final includes the upstream fix (commit 9e2c400f89) which was shipped in Netty 4.1.1.Final (May 2016). The vulnerable infinite loop pattern in SSL_ERROR_WANT_READ/WANT_WRITE handling is not present in the target. The fix is in ReferenceCountedOpenSslEngine.java lines 1001-1024, where both error cases now return immediately instead of using break statements that would cause infinite looping.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:50:05.608703+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler. CVE-2020-11612 is not present in Netty 4.1.100.Final. The upstream fix (commit 1543218d3e) was already included in the upstream release that TuxCare onboarded. The fix adds a configurable maxAllocation parameter to ZlibDecoder and its subclasses (JdkZlibDecoder, JZlibDecoder) along with a prepareDecompressBuffer() method that enforces buffer size limits during decompression, preventing unbounded memory allocation attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 is not present in Netty 4.1.100.Final. The upstream fix (commit 1543218d3e) was already included in the upstream release that TuxCare onboarded. The fix adds a configurable maxAllocation parameter to ZlibDecoder and its subclasses (JdkZlibDecoder, JZlibDecoder) along with a prepareDecompressBuffer() method that enforces buffer size limits during decompression, preventing unbounded memory allocation attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:50:05.608703+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:50:05.608703+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 is NOT AFFECTED in Netty 4.1.100.Final-tuxcare.1. The upstream fix (commit 535da17e45 by Norman Maurer, June 2023) was already present in Netty 4.1.100.Final when TuxCare onboarded it. The target code contains complete validation that limits ClientHello handshake length to a configurable maximum (default 64KB), preventing the unbounded 16MB heap allocation vulnerability. The fix ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34462 is NOT AFFECTED in Netty 4.1.100.Final-tuxcare.1. The upstream fix (commit 535da17e45 by Norman Maurer, June 2023) was already present in Netty 4.1.100.Final when TuxCare onboarded it. The target code contains complete validation that limits ClientHello handshake length to a configurable maximum (default 64KB), preventing the unbounded 16MB heap allocation vulnerability. The fix ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:50:05.608703+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.100.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T08:29:38.625114+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler, and is fixed in 4.1.100.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      },
      "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler, and is fixed in 4.1.100.Final-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:50:05.608703+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:50:05.608703+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:50:05.608703+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:50:05.608703+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:50:05.608703+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:50:05.608703+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.100.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T19:50:05.608703+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.100.Final-tuxcare.2 of io.netty:netty-handler."
    }
  ]
}