{
  "@id": "urn:uuid:86c13a03-58fa-4af6-9f45-c19788e7aeac",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:12:34.459172+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T18:12:19.286874+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 describes an infinite loop vulnerability in Netty's SslHandler when processing SSLv2Hello messages requiring buffers larger than the pooled capacity. The target (Netty 4.1.117.Final-tuxcare.4) is NOT AFFECTED because the upstream fix was already present in the release version that TuxCare onboarded. The fix (commit 9660e2f6a98, 2015-07-07 by Norman Maurer) adds proper BUFFER_OVERF...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 describes an infinite loop vulnerability in Netty's SslHandler when processing SSLv2Hello messages requiring buffers larger than the pooled capacity. The target (Netty 4.1.117.Final-tuxcare.4) is NOT AFFECTED because the upstream fix was already present in the release version that TuxCare onboarded. The fix (commit 9660e2f6a98, 2015-07-07 by Norman Maurer) adds proper BUFFER_OVERF..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:45:34.333226+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler. CVE-2016-4970 is NOT present in target version 4.1.117.Final. The vulnerability (infinite loop in OpenSslEngine when SSL_write returns WANT_READ/WANT_WRITE with empty BIO buffer) was fixed in upstream Netty 4.1.1.Final (June 2016) by commit 524156f164. The fix is present in ReferenceCountedOpenSslEngine.java:1002-1025, where both error conditions immediately return control to the event loop instead of spinning. Target version 4.1.117.Final was onboarded by TuxCare with the fix already present in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 is NOT present in target version 4.1.117.Final. The vulnerability (infinite loop in OpenSslEngine when SSL_write returns WANT_READ/WANT_WRITE with empty BIO buffer) was fixed in upstream Netty 4.1.1.Final (June 2016) by commit 524156f164. The fix is present in ReferenceCountedOpenSslEngine.java:1002-1025, where both error conditions immediately return control to the event loop instead of spinning. Target version 4.1.117.Final was onboarded by TuxCare with the fix already present in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler. The target Netty 4.1.117.Final already contains the upstream fix for CVE-2020-11612. The vulnerability (unbounded memory allocation during Zlib decompression) is not present because the maxAllocation defense mechanism was added in upstream commit 1543218d3e (January 2020) by Rich DiCroce and shipped in Netty 4.1.46.Final. The target version 4.1.117.Final includes this fix as part of its upstream release, onboarded by TuxCare without modification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "The target Netty 4.1.117.Final already contains the upstream fix for CVE-2020-11612. The vulnerability (unbounded memory allocation during Zlib decompression) is not present because the maxAllocation defense mechanism was added in upstream commit 1543218d3e (January 2020) by Rich DiCroce and shipped in Netty 4.1.46.Final. The target version 4.1.117.Final includes this fix as part of its upstream release, onboarded by TuxCare without modification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T03:28:09.355486+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T12:28:33.638846+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler. not_affected \u2014 Target repository Netty 4.1.117.Final is NOT AFFECTED by CVE-2023-34462. The fix for unbounded ClientHello memory allocation was already included in upstream Netty 4.1.117.Final (commit 535da17e45 by Norman Maurer) before TuxCare's onboarding. The vulnerable pattern described in the CVE (allocating up to 16MB per connection based on unchecked ClientHello length) does not exist in this version -...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 Target repository Netty 4.1.117.Final is NOT AFFECTED by CVE-2023-34462. The fix for unbounded ClientHello memory allocation was already included in upstream Netty 4.1.117.Final (commit 535da17e45 by Norman Maurer) before TuxCare's onboarding. The vulnerable pattern described in the CVE (allocating up to 16MB per connection based on unchecked ClientHello length) does not exist in this version -..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.117.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.117.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.117.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    }
  ]
}