{
  "@id": "urn:uuid:b34bb7d8-1559-444f-b008-92f30f9e218e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 27,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:32:00.049964+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:07:42.652285+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x before 3.9.2 due to fixed-size SslBufferPool causing infinite BUFFER_OVERFLOW loops with SSLv2Hello messages. The target (Netty 4.1.111.Final) uses a fundamentally different architecture with dynamic ByteBufAllocator and contains upstream fixes (commits 9660e2f6a9, 052a171a52, 2055f4cf12) that properly handle BUFFER_OVERFLOW by allocating buffers based on engine....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x before 3.9.2 due to fixed-size SslBufferPool causing infinite BUFFER_OVERFLOW loops with SSLv2Hello messages. The target (Netty 4.1.111.Final) uses a fundamentally different architecture with dynamic ByteBufAllocator and contains upstream fixes (commits 9660e2f6a9, 052a171a52, 2055f4cf12) that properly handle BUFFER_OVERFLOW by allocating buffers based on engine...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:35:45.229167+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler. CVE-2016-4970 affects Netty versions before 4.1.1.Final. The target is running version 4.1.111.Final, which is significantly newer and includes the upstream fix from May 2016 (commit 524156f164). The fix modifies SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE handling in the SSL engine to prevent infinite loops when the BIO buffer is empty. The vulnerable code pattern is not present in the target; the fix was shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty versions before 4.1.1.Final. The target is running version 4.1.111.Final, which is significantly newer and includes the upstream fix from May 2016 (commit 524156f164). The fix modifies SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE handling in the SSL engine to prevent infinite loops when the BIO buffer is empty. The vulnerable code pattern is not present in the target; the fix was shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T18:02:00.055561+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 does not affect version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler. Prechecker: The upstream fix is already in this version's source history (commits 5f688978, 62903462, 8494b046). The upstream fix was released in 4.1.45, and version 4.1.111.Final is a later release of the same line. Advisories: GitHub GHSA-p2v9-g2qv-p635 (fixed in 4.1.45), NVD (fixed in 4.1.44).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 5f688978, 62903462, 8494b046). The upstream fix was released in 4.1.45, and version 4.1.111.Final is a later release of the same line. Advisories: GitHub GHSA-p2v9-g2qv-p635 (fixed in 4.1.45), NVD (fixed in 4.1.44)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler. CVE-2020-11612 (unbounded memory allocation in ZlibDecoders) fix is present in the target repository. The fix (maxAllocation parameter with prepareDecompressBuffer enforcement) was introduced in upstream Netty 4.1.46.Final by Rich DiCroce and shipped in the 4.1.111.Final release that TuxCare onboarded. However, the protection is disabled by default (maxAllocation=0 allows buffers to grow to Integer.MAX_VALUE). Users handling untrusted input must explicitly configure maxAllocation > 0 to activate the defense. The target is not affected because the fix code exists and only requires configuration to enable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 (unbounded memory allocation in ZlibDecoders) fix is present in the target repository. The fix (maxAllocation parameter with prepareDecompressBuffer enforcement) was introduced in upstream Netty 4.1.46.Final by Rich DiCroce and shipped in the 4.1.111.Final release that TuxCare onboarded. However, the protection is disabled by default (maxAllocation=0 allows buffers to grow to Integer.MAX_VALUE). Users handling untrusted input must explicitly configure maxAllocation > 0 to activate the defense. The target is not affected because the fix code exists and only requires configuration to enable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T18:32:00.049964+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler. Prechecker: The upstream fix is already in this version's source history (commits 5f688978, 8494b046). The upstream fix was released in 4.1.45, and version 4.1.111.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 5f688978, 8494b046). The upstream fix was released in 4.1.45, and version 4.1.111.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:21:10.077457+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 fix was already present in the upstream Netty 4.1.111.Final release that TuxCare onboarded. The upstream commit 535da17e45201ae4278c0479e6162bb4127d4c32 by Norman Maurer (norman_maurer@apple.com) introduced maxClientHelloLength validation with a 64KB default limit, preventing the excessive heap allocation vulnerability. The fix is present in SslClientHelloHandler.java (lines 49, ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34462 fix was already present in the upstream Netty 4.1.111.Final release that TuxCare onboarded. The upstream commit 535da17e45201ae4278c0479e6162bb4127d4c32 by Norman Maurer (norman_maurer@apple.com) introduced maxClientHelloLength validation with a 64KB default limit, preventing the excessive heap allocation vulnerability. The fix is present in SslClientHelloHandler.java (lines 49, ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.111.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.111.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.111.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    }
  ]
}