{
  "@id": "urn:uuid:e60ee42c-0fa0-4251-8eb0-79c3b3e1485b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T18:03:26.833936+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affected Netty 3.x (before 3.9.2) where SSLv2Hello messages caused infinite loops due to BUFFER_OVERFLOW status. The target is Netty 4.1.128.Final which has a different architecture (io.netty vs org.jboss.netty). The vulnerable code pattern is not present because Netty 4.x has had BUFFER_OVERFLOW handling since its 2012 rewrite (commit 50fafdc3d3) that prevents infinite loops by d...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affected Netty 3.x (before 3.9.2) where SSLv2Hello messages caused infinite loops due to BUFFER_OVERFLOW status. The target is Netty 4.1.128.Final which has a different architecture (io.netty vs org.jboss.netty). The vulnerable code pattern is not present because Netty 4.x has had BUFFER_OVERFLOW handling since its 2012 rewrite (commit 50fafdc3d3) that prevents infinite loops by d..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler. CVE-2016-4970 (infinite loop DoS in OpenSslEngine) is NOT present in target version 4.1.128.Final. The upstream fix was already included in the 4.1.128.Final release when TuxCare onboarded it. The vulnerable pattern (infinite loop when SSL_ERROR_WANT_READ occurs with empty BIO buffer) has been eliminated by proper error handling that yields control to the event loop. Fix authored by upstream developer scott_mitchell@apple.com (Apple) and shipped in upstream Netty 4.1.1.Final (May 2016).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 (infinite loop DoS in OpenSslEngine) is NOT present in target version 4.1.128.Final. The upstream fix was already included in the 4.1.128.Final release when TuxCare onboarded it. The vulnerable pattern (infinite loop when SSL_ERROR_WANT_READ occurs with empty BIO buffer) has been eliminated by proper error handling that yields control to the event loop. Fix authored by upstream developer scott_mitchell@apple.com (Apple) and shipped in upstream Netty 4.1.1.Final (May 2016).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 does not affect version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.128.Final is a later release of the same line. Advisories: GitHub GHSA-p2v9-g2qv-p635 (fixed in 4.1.45), NVD (fixed in 4.1.44).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.128.Final is a later release of the same line. Advisories: GitHub GHSA-p2v9-g2qv-p635 (fixed in 4.1.45), NVD (fixed in 4.1.44)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler. CVE-2020-11612 affects Netty 4.1.x before 4.1.46. The target version 4.1.128.Final contains the upstream fix (commit 1543218d3e) that was introduced in Netty 4.1.46.Final. The fix adds a configurable maxAllocation parameter to ZlibDecoder and its subclasses, replacing unbounded buffer allocation with size-limited allocation via prepareDecompressBuffer(). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 affects Netty 4.1.x before 4.1.46. The target version 4.1.128.Final contains the upstream fix (commit 1543218d3e) that was introduced in Netty 4.1.46.Final. The fix adds a configurable maxAllocation parameter to ZlibDecoder and its subclasses, replacing unbounded buffer allocation with size-limited allocation via prepareDecompressBuffer(). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler. CVE-2020-7238 is NOT present in Netty 4.1.128.Final-tuxcare.2. The vulnerability was fixed by upstream commit 8494b046ec (authored by Norman Maurer) which adds validation to reject HTTP/1.1 requests containing both Transfer-Encoding: chunked and Content-Length headers. This fix was shipped in the upstream Netty 4.1.128.Final release and was subsequently onboarded by TuxCare. The vulnerable pattern (accepting both headers simultaneously) is absent from the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "CVE-2020-7238 is NOT present in Netty 4.1.128.Final-tuxcare.2. The vulnerability was fixed by upstream commit 8494b046ec (authored by Norman Maurer) which adds validation to reject HTTP/1.1 requests containing both Transfer-Encoding: chunked and Content-Length headers. This fix was shipped in the upstream Netty 4.1.128.Final release and was subsequently onboarded by TuxCare. The vulnerable pattern (accepting both headers simultaneously) is absent from the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler. not_affected \u2014 Target version 4.1.128.Final is NOT affected by CVE-2023-34462. The vulnerability allowed attackers to allocate up to 16MB of heap memory per connection via crafted ClientHello messages, potentially causing OutOfMemoryError. The fix (commit 535da17e45, June 2023) introduced a configurable maxClientHelloLength parameter (default 64KB) that validates ClientHello length before buffer allocation an...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.128.Final is NOT affected by CVE-2023-34462. The vulnerability allowed attackers to allocate up to 16MB of heap memory per connection via crafted ClientHello messages, potentially causing OutOfMemoryError. The fix (commit 535da17e45, June 2023) introduced a configurable maxClientHelloLength parameter (default 64KB) that validates ClientHello length before buffer allocation an..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.128.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 does not affect version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler. The target Netty 4.1.128.Final is NOT AFFECTED by CVE-2025-24970. All three defensive code changes from the vendor patches are already present in HEAD, installed by upstream commits dc6b051d (Feb 14, 2025) and 87f40725 (Feb 10, 2025) by Jonas Konrad and Norman Maurer respectively, both BEFORE TuxCare's onboarding commit b72e63fd (Oct 1, 2026). The vulnerability pattern (improper validation of SSL packet lengths leading to buffer corruption/crash) is not present because the upstream Netty vendor already fixed it in version 4.1.128.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.91.Final, < 4.1.118.Final), NVD (>= 4.1.91, < 4.1.118), cve.org (>= 4.1.91.Final, <= 4.1.117.Final), Snyk (>= 4.1.91.Final, < 4.1.118.Final; >= 4.2.0.Alpha1, < 4.2.0.RC3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-24970"
      },
      "impact_statement": "The target Netty 4.1.128.Final is NOT AFFECTED by CVE-2025-24970. All three defensive code changes from the vendor patches are already present in HEAD, installed by upstream commits dc6b051d (Feb 14, 2025) and 87f40725 (Feb 10, 2025) by Jonas Konrad and Norman Maurer respectively, both BEFORE TuxCare's onboarding commit b72e63fd (Oct 1, 2026). The vulnerability pattern (improper validation of SSL packet lengths leading to buffer corruption/crash) is not present because the upstream Netty vendor already fixed it in version 4.1.128.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.91.Final, < 4.1.118.Final), NVD (>= 4.1.91, < 4.1.118), cve.org (>= 4.1.91.Final, <= 4.1.117.Final), Snyk (>= 4.1.91.Final, < 4.1.118.Final; >= 4.2.0.Alpha1, < 4.2.0.RC3)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-13T18:03:26.833936+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler, and is fixed in 4.1.128.Final-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler, and is fixed in 4.1.128.Final-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.128.Final-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T08:04:43.899001+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.128.Final-tuxcare.6 of io.netty:netty-handler."
    }
  ]
}