{
  "@id": "urn:uuid:a9687386-aeae-4736-ab64-6a206c19a90a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T07:24:48.998105+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x (org.jboss.netty package) where SslBufferPool's fixed-size buffer limitation caused infinite BUFFER_OVERFLOW loops when processing SSLv2Hello messages requiring >30KB buffers. The target is Netty 4.1.113.Final (io.netty package) with fundamentally different architecture using ByteBufAllocator for dynamic buffer allocation. The equivalent protection was added by u...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x (org.jboss.netty package) where SslBufferPool's fixed-size buffer limitation caused infinite BUFFER_OVERFLOW loops when processing SSLv2Hello messages requiring >30KB buffers. The target is Netty 4.1.113.Final (io.netty package) with fundamentally different architecture using ByteBufAllocator for dynamic buffer allocation. The equivalent protection was added by u..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler. CVE-2016-4970 (infinite loop in OpenSslEngine) is NOT present in the target. The vulnerability affected Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version is 4.1.113.Final, which is far beyond the first fixed version (4.1.1.Final). The fix for this CVE was authored by Scott Mitchell (scott_mitchell@apple.com) in commit 9e2c400f89 on 2016-05-27 and shipped in upstream Netty 4.1.1.Final. This fix was already present in the 4.1.113.Final release that TuxCare onboarded (commit 5ec21010e97c). The vulnerable infinite loop pattern cannot occur in the target's code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 (infinite loop in OpenSslEngine) is NOT present in the target. The vulnerability affected Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version is 4.1.113.Final, which is far beyond the first fixed version (4.1.1.Final). The fix for this CVE was authored by Scott Mitchell (scott_mitchell@apple.com) in commit 9e2c400f89 on 2016-05-27 and shipped in upstream Netty 4.1.1.Final. This fix was already present in the 4.1.113.Final release that TuxCare onboarded (commit 5ec21010e97c). The vulnerable infinite loop pattern cannot occur in the target's code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler. CVE-2020-11612 affects Netty 4.1.x before 4.1.46. The target is Netty 4.1.113.Final, which already contains the upstream fix (commit 1543218d3e) that adds maxAllocation limits to ZlibDecoders to prevent unbounded memory allocation during decompression. The fix was authored by Rich DiCroce from Scientific Games and shipped in Netty 4.1.46, well before the 4.1.113.Final release that TuxCare onboarded. The vulnerable code pattern (unbounded buffer allocation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 affects Netty 4.1.x before 4.1.46. The target is Netty 4.1.113.Final, which already contains the upstream fix (commit 1543218d3e) that adds maxAllocation limits to ZlibDecoders to prevent unbounded memory allocation during decompression. The fix was authored by Rich DiCroce from Scientific Games and shipped in Netty 4.1.46, well before the 4.1.113.Final release that TuxCare onboarded. The vulnerable code pattern (unbounded buffer allocation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 is NOT present in the target. The vulnerability involved unbounded ByteBuf allocation in SslClientHelloHandler based on an unchecked attacker-controlled handshakeLength field, allowing up to 16MB heap allocation per connection. The fix adds validation that rejects handshakeLength values exceeding a configurable maximum (defaulting to RFC5246's 16MB limit). This fix is present in ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34462 is NOT present in the target. The vulnerability involved unbounded ByteBuf allocation in SslClientHelloHandler based on an unchecked attacker-controlled handshakeLength field, allowing up to 16MB heap allocation per connection. The fix adds validation that rejects handshakeLength values exceeding a configurable maximum (defaulting to RFC5246's 16MB limit). This fix is present in ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.113.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 is fixed in version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 is fixed in version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.113.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T07:24:48.998105+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.113.Final-tuxcare.6 of io.netty:netty-handler."
    }
  ]
}