{ "@id": "urn:uuid:354586dd-1713-4de0-88a6-e579b9b8916f", "role": "Document Creator", "author": "https://tuxcare.com", "version": 26, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:12:34.459172+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:02:36.547436+00:00", "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty's SslHandler causing infinite loop/DoS when processing SSLv2Hello messages due to BUFFER_OVERFLOW handling. The target (Netty 4.1.119.Final) is NOT AFFECTED. The vulnerability pattern is not present because proper BUFFER_OVERFLOW handling was already included in the upstream release. When SSLEngine returns BUFFER_OVERFLOW (e.g., SSLv2Hello requiring >30KB buffer), th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3488" }, "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty's SslHandler causing infinite loop/DoS when processing SSLv2Hello messages due to BUFFER_OVERFLOW handling. The target (Netty 4.1.119.Final) is NOT AFFECTED. The vulnerability pattern is not present because proper BUFFER_OVERFLOW handling was already included in the upstream release. When SSLEngine returns BUFFER_OVERFLOW (e.g., SSLv2Hello requiring >30KB buffer), th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T12:31:15.270922+00:00", "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler. CVE-2016-4970 describes an infinite loop vulnerability in OpenSslEngine.wrap() when SSL_write returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with no data in the BIO buffer. The target Netty 4.1.119.Final is not affected because the vulnerable code pattern is not present. The upstream fix, which makes the code return control to the event loop (NEED_UNWRAP/NEED_WRAP) instead of continuing the loop, was introduced by Scott Mitchell in upstream commit d06990f434 (December 2016) and shipped in upstream Netty 4.1.1.Final. The target version 4.1.119.Final inherited this fix from upstream when TuxCare onboarded it in August 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4970" }, "impact_statement": "CVE-2016-4970 describes an infinite loop vulnerability in OpenSslEngine.wrap() when SSL_write returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with no data in the BIO buffer. The target Netty 4.1.119.Final is not affected because the vulnerable code pattern is not present. The upstream fix, which makes the code return control to the event loop (NEED_UNWRAP/NEED_WRAP) instead of continuing the loop, was introduced by Scott Mitchell in upstream commit d06990f434 (December 2016) and shipped in upstream Netty 4.1.1.Final. The target version 4.1.119.Final inherited this fix from upstream when TuxCare onboarded it in August 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T09:07:59.808671+00:00", "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler. CVE-2020-11612 affects Netty 4.1.x before 4.1.46. The target is Netty 4.1.119.Final-tuxcare.3, which already contains the upstream fix (commit 1543218d) that shipped in the upstream release. The fix adds a configurable maxAllocation parameter to ZlibDecoder and its subclasses, preventing unbounded memory allocation during decompression. All buffer allocations go through prepareDecompressBuffer(), which enforces the limit and throws DecompressionException when reached. No bypass paths exist. The vulnerable pattern (unbounded decompression buffer allocation) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11612" }, "impact_statement": "CVE-2020-11612 affects Netty 4.1.x before 4.1.46. The target is Netty 4.1.119.Final-tuxcare.3, which already contains the upstream fix (commit 1543218d) that shipped in the upstream release. The fix adds a configurable maxAllocation parameter to ZlibDecoder and its subclasses, preventing unbounded memory allocation during decompression. All buffer allocations go through prepareDecompressBuffer(), which enforces the limit and throws DecompressionException when reached. No bypass paths exist. The vulnerable pattern (unbounded decompression buffer allocation) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler. The target Netty 4.1.119.Final is NOT AFFECTED by CVE-2020-7238. The vulnerability (HTTP Request Smuggling via conflicting Content-Length/Transfer-Encoding headers) was fixed in upstream commit 8494b046ec, which shipped in the upstream release 2044 commits before TuxCare's onboarding. Both required defenses are present and active by default: (1) HttpUtil.normalizeAndGetContentLength (lines 649-671) rejects multiple Content-Length headers with IllegalArgumentException when allowDuplicateContentLengths=false (default); (2) HttpObjectDecoder.handleTransferEncodingChunkedWithContentLength (lines 925-935) throws ContentLengthNotAllowedException when both Content-Length and Transfer-Encoding headers are present in HTTP/1.1 messages with useRfc9112TransferEncoding=true (default). The current implementation is an evolved, more robust version of the original 2019 fix, with dedicated exception types and RFC 9112 compliance.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-7238" }, "impact_statement": "The target Netty 4.1.119.Final is NOT AFFECTED by CVE-2020-7238. The vulnerability (HTTP Request Smuggling via conflicting Content-Length/Transfer-Encoding headers) was fixed in upstream commit 8494b046ec, which shipped in the upstream release 2044 commits before TuxCare's onboarding. Both required defenses are present and active by default: (1) HttpUtil.normalizeAndGetContentLength (lines 649-671) rejects multiple Content-Length headers with IllegalArgumentException when allowDuplicateContentLengths=false (default); (2) HttpObjectDecoder.handleTransferEncodingChunkedWithContentLength (lines 925-935) throws ContentLengthNotAllowedException when both Content-Length and Transfer-Encoding headers are present in HTTP/1.1 messages with useRfc9112TransferEncoding=true (default). The current implementation is an evolved, more robust version of the original 2019 fix, with dedicated exception types and RFC 9112 compliance.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-10-31T12:17:41.297834+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 is NOT present in Netty 4.1.119.Final-tuxcare.3. The upstream fix (commit 535da17e45201ae4278c0479e6162bb4127d4c32 by Norman Maurer, June 2023) added validation to enforce maxClientHelloLength limits, preventing unbounded memory allocation during TLS handshake. This fix was already shipped in upstream Netty 4.1.119.Final when TuxCare onboarded it (commit 511e28ce70). The target a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 CVE-2023-34462 is NOT present in Netty 4.1.119.Final-tuxcare.3. The upstream fix (commit 535da17e45201ae4278c0479e6162bb4127d4c32 by Norman Maurer, June 2023) added validation to enforce maxClientHelloLength limits, preventing unbounded memory allocation during TLS handshake. This fix was already shipped in upstream Netty 4.1.119.Final when TuxCare onboarded it (commit 511e28ce70). The target a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.119.Final-tuxcare.3.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T11:58:46.516698+00:00", "status_notes": "Vulnerability CVE-2025-24970 does not affect version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler. The target netty 4.1.119.Final-tuxcare.3 is NOT AFFECTED by CVE-2025-24970. All fixes for this vulnerability were already present in the upstream 4.1.119.Final release before TuxCare onboarded it. The vulnerable pattern (missing validation of SSL packet lengths leading to potential native crash) is not present. Two upstream commits installed the complete fix: 87f40725 (Norman Maurer, Apple, Feb 10 2025) added validation checks in SslUtils and ReferenceCountedOpenSslEngine, and dc6b051d (Jonas Konrad, Oracle, Feb 14 2025) replaced a vulnerable assertion with explicit error handling in SslHandler. Both commits are ancestors of the TuxCare onboarding commit 511e28ce.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.91.Final, < 4.1.118.Final), NVD (>= 4.1.91, < 4.1.118), cve.org (>= 4.1.91.Final, <= 4.1.117.Final), Snyk (>= 4.1.91.Final, < 4.1.118.Final; >= 4.2.0.Alpha1, < 4.2.0.RC3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24970" }, "impact_statement": "The target netty 4.1.119.Final-tuxcare.3 is NOT AFFECTED by CVE-2025-24970. All fixes for this vulnerability were already present in the upstream 4.1.119.Final release before TuxCare onboarded it. The vulnerable pattern (missing validation of SSL packet lengths leading to potential native crash) is not present. Two upstream commits installed the complete fix: 87f40725 (Norman Maurer, Apple, Feb 10 2025) added validation checks in SslUtils and ReferenceCountedOpenSslEngine, and dc6b051d (Jonas Konrad, Oracle, Feb 14 2025) replaced a vulnerable assertion with explicit error handling in SslHandler. Both commits are ancestors of the TuxCare onboarding commit 511e28ce.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.91.Final, < 4.1.118.Final), NVD (>= 4.1.91, < 4.1.118), cve.org (>= 4.1.91.Final, <= 4.1.117.Final), Snyk (>= 4.1.91.Final, < 4.1.118.Final; >= 4.2.0.Alpha1, < 4.2.0.RC3)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-44249" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-45416" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-50010" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75595 is fixed in version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75595" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75596 is fixed in version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75596" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.119.Final-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.119.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" } } ] }