{
  "@id": "urn:uuid:7c548ccc-6b87-4d98-a10d-07ebbb76342f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 25,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:31:00.049800+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:03:00.503218+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 (SSLv2Hello infinite loop DoS) is NOT present in Netty 4.1.114.Final. The vulnerable pattern was fixed in upstream Netty 4.x in June 2012 (commit 50fafdc3d by Trustin Lee), two years BEFORE the CVE was discovered in Netty 3.x. The target contains the fix: BUFFER_OVERFLOW status triggers dynamic buffer allocation sized to engine.getSession().getApplicationBufferSize() (lines 1510-1...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 (SSLv2Hello infinite loop DoS) is NOT present in Netty 4.1.114.Final. The vulnerable pattern was fixed in upstream Netty 4.x in June 2012 (commit 50fafdc3d by Trustin Lee), two years BEFORE the CVE was discovered in Netty 3.x. The target contains the fix: BUFFER_OVERFLOW status triggers dynamic buffer allocation sized to engine.getSession().getApplicationBufferSize() (lines 1510-1..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:32:43.249791+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version 4.1.114.Final already contains the upstream fix. The vulnerability involved an infinite loop when SSL_write returned SSL_ERROR_WANT_READ with an empty BIO buffer. The fix (commit cd3bf3df58) was authored by Scott Mitchell (scott_mitchell@apple.com) and was already present in the upstream 4.1.114.Final release before TuxCare onboarded it (onboarding commit 57dabd31dd by amoniatovskiy@cloudlinux.com). The defense logic is present in ReferenceCountedOpenSslEngine.java lines 1002-1025, which properly handles SSL_ERROR_WANT_READ by returning NEED_UNWRAP and SSL_ERROR_WANT_WRITE by returning appropriate status, preventing the infinite loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version 4.1.114.Final already contains the upstream fix. The vulnerability involved an infinite loop when SSL_write returned SSL_ERROR_WANT_READ with an empty BIO buffer. The fix (commit cd3bf3df58) was authored by Scott Mitchell (scott_mitchell@apple.com) and was already present in the upstream 4.1.114.Final release before TuxCare onboarded it (onboarding commit 57dabd31dd by amoniatovskiy@cloudlinux.com). The defense logic is present in ReferenceCountedOpenSslEngine.java lines 1002-1025, which properly handles SSL_ERROR_WANT_READ by returning NEED_UNWRAP and SSL_ERROR_WANT_WRITE by returning appropriate status, preventing the infinite loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler. The target Netty 4.1.114.Final already contains the fix for CVE-2020-11612. The fix (commit 1543218d3e) was authored by upstream Netty contributor Rich DiCroce and shipped in version 4.1.46. The vulnerable pattern (unbounded memory allocation during Zlib decompression) is not present in the target code. All three affected decoder classes (ZlibDecoder, JZlibDecoder, JdkZlibDecoder) implement the maxAllocation defense mechanism through the prepareDecompressBuffer() method, which limits buffer allocation and throws DecompressionException when limits are exceeded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "The target Netty 4.1.114.Final already contains the fix for CVE-2020-11612. The fix (commit 1543218d3e) was authored by upstream Netty contributor Rich DiCroce and shipped in version 4.1.46. The vulnerable pattern (unbounded memory allocation during Zlib decompression) is not present in the target code. All three affected decoder classes (ZlibDecoder, JZlibDecoder, JdkZlibDecoder) implement the maxAllocation defense mechanism through the prepareDecompressBuffer() method, which limits buffer allocation and throws DecompressionException when limits are exceeded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T18:31:00.049800+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.114.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.114.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:20:03.206319+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 describes a DoS vulnerability where SniHandler can allocate up to 16MB heap per connection by processing attacker-controlled handshake length in TLS ClientHello without validation. The target Netty 4.1.114.Final contains the upstream fix (commit 535da17e45) that validates handshake length against a configurable maximum (defaulting to 64KB) and throws TooLongFrameException if exce...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34462 describes a DoS vulnerability where SniHandler can allocate up to 16MB heap per connection by processing attacker-controlled handshake length in TLS ClientHello without validation. The target Netty 4.1.114.Final contains the upstream fix (commit 535da17e45) that validates handshake length against a configurable maximum (defaulting to 64KB) and throws TooLongFrameException if exce..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.114.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T08:49:00.071900+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler, and is fixed in 4.1.114.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler, and is fixed in 4.1.114.Final-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 is fixed in version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 is fixed in version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.114.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T19:32:48.777555+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.114.Final-tuxcare.2 of io.netty:netty-handler."
    }
  ]
}