{
  "@id": "urn:uuid:56bd3837-63c9-47b3-adeb-2d4597cd8c2a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:29:00.082027+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x before version 3.9.2, where SslHandler used a fixed-size pooled buffer causing infinite loops on BUFFER_OVERFLOW when processing SSLv2Hello messages. The target is Netty 4.1.101.Final, which has a fundamentally different architecture. Netty 4.x has had proper BUFFER_OVERFLOW handling since its June 2012 SslHandler rewrite (commit 50fafdc3d3 by Trustin Lee), two y...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x before version 3.9.2, where SslHandler used a fixed-size pooled buffer causing infinite loops on BUFFER_OVERFLOW when processing SSLv2Hello messages. The target is Netty 4.1.101.Final, which has a fundamentally different architecture. Netty 4.x has had proper BUFFER_OVERFLOW handling since its June 2012 SslHandler rewrite (commit 50fafdc3d3 by Trustin Lee), two y..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final. The target version is 4.1.101.Final, which is 100 releases after the fixed version. The vulnerability pattern (infinite loop in OpenSslEngine.wrap() when SSL_ERROR_WANT_READ/WANT_WRITE occurs with empty BIO buffer) is not present in the target. The fix commit (9e2c400f89c5badc39919f811179d3d42ac5257c) by upstream developer scott_mitchell@apple.com was included in the upstream 4.1.1.Final release (2016) and was already present when TuxCare onboarded version 4.1.101.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final. The target version is 4.1.101.Final, which is 100 releases after the fixed version. The vulnerability pattern (infinite loop in OpenSslEngine.wrap() when SSL_ERROR_WANT_READ/WANT_WRITE occurs with empty BIO buffer) is not present in the target. The fix commit (9e2c400f89c5badc39919f811179d3d42ac5257c) by upstream developer scott_mitchell@apple.com was included in the upstream 4.1.1.Final release (2016) and was already present when TuxCare onboarded version 4.1.101.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler. Target Netty 4.1.101.Final is not affected by CVE-2020-11612. The fix for unbounded memory allocation in ZlibDecoders was already present in the upstream Netty 4.1.101.Final release that TuxCare onboarded. The fix commit (1543218d3e, dated 2020-01-31) added a configurable maxAllocation parameter to ZlibDecoder and its subclasses (JZlibDecoder, JdkZlibDecoder) to prevent memory exhaustion attacks. This commit is an ancestor of the TuxCare onboarding commit (084e08ed54, dated 2026-10-01), confirming the fix was in the upstream release. The vulnerable pattern (unbounded decompression buffer allocation) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "Target Netty 4.1.101.Final is not affected by CVE-2020-11612. The fix for unbounded memory allocation in ZlibDecoders was already present in the upstream Netty 4.1.101.Final release that TuxCare onboarded. The fix commit (1543218d3e, dated 2020-01-31) added a configurable maxAllocation parameter to ZlibDecoder and its subclasses (JZlibDecoder, JdkZlibDecoder) to prevent memory exhaustion attacks. This commit is an ancestor of the TuxCare onboarding commit (084e08ed54, dated 2026-10-01), confirming the fix was in the upstream release. The vulnerable pattern (unbounded decompression buffer allocation) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T18:29:00.082027+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.101.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.101.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 fix was already present in the upstream Netty 4.1.101.Final release when TuxCare onboarded it. The vulnerability pattern (unbounded heap allocation up to 16MB based on attacker-controlled ClientHello handshake length field) is not present in the target. The validation logic that throws TooLongFrameException when handshakeLength exceeds maxClientHelloLength is present in SslClient...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34462 fix was already present in the upstream Netty 4.1.101.Final release when TuxCare onboarded it. The vulnerability pattern (unbounded heap allocation up to 16MB based on attacker-controlled ClientHello handshake length field) is not present in the target. The validation logic that throws TooLongFrameException when handshakeLength exceeds maxClientHelloLength is present in SslClient..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.101.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.101.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T11:11:29.632568+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.101.Final-tuxcare.3 of io.netty:netty-handler."
    }
  ]
}