{ "@id": "urn:uuid:77dc7f6f-7ad1-4fa4-a02b-7160a3e6b6e3", "role": "Document Creator", "author": "https://tuxcare.com", "version": 27, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T18:03:00.046051+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-11-03T18:09:52.592274+00:00", "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 (SSLv2Hello infinite loop) is NOT present in Netty 4.1.130.Final. The fix was introduced in upstream Netty 4.1.0.Beta6 (July 2015) by Norman Maurer, well before this version. The target contains BUFFER_OVERFLOW handling that dynamically allocates buffers based on SSLEngine's required applicationBufferSize, preventing the infinite retry loop that affected Netty 3.x versions before ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3488" }, "impact_statement": "not_affected \u2014 CVE-2014-3488 (SSLv2Hello infinite loop) is NOT present in Netty 4.1.130.Final. The fix was introduced in upstream Netty 4.1.0.Beta6 (July 2015) by Norman Maurer, well before this version. The target contains BUFFER_OVERFLOW handling that dynamically allocates buffers based on SSLEngine's required applicationBufferSize, preventing the infinite retry loop that affected Netty 3.x versions before ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-11-03T12:43:21.485909+00:00", "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target is version 4.1.130.Final, which already includes the upstream fix committed by Scott Mitchell on 2016-05-27 (commit 9e2c400f89c5badc39919f811179d3d42ac5257c). The fix properly handles SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE by returning control to the event loop instead of continuing in an infinite loop. The vulnerable pattern is not present because the fix was shipped in netty-4.1.1.Final, which predates the TuxCare onboarding of version 4.1.130.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4970" }, "impact_statement": "CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target is version 4.1.130.Final, which already includes the upstream fix committed by Scott Mitchell on 2016-05-27 (commit 9e2c400f89c5badc39919f811179d3d42ac5257c). The fix properly handles SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE by returning control to the event loop instead of continuing in an infinite loop. The vulnerable pattern is not present because the fix was shipped in netty-4.1.1.Final, which predates the TuxCare onboarding of version 4.1.130.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-11-06T18:03:00.046051+00:00", "status_notes": "Vulnerability CVE-2019-20445 does not affect version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.130.Final is a later release of the same line. Advisories: GitHub GHSA-p2v9-g2qv-p635 (fixed in 4.1.45), NVD (fixed in 4.1.44).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20445" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.130.Final is a later release of the same line. Advisories: GitHub GHSA-p2v9-g2qv-p635 (fixed in 4.1.45), NVD (fixed in 4.1.44)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler. The target repository (Netty 4.1.130.Final-tuxcare.4) is NOT AFFECTED by CVE-2020-11612. The vulnerability (unbounded memory allocation in ZlibDecoders) was fixed in upstream Netty via commit 1543218d3e, which introduced configurable allocation limits through the maxAllocation parameter. This fix was already present in the upstream Netty 4.1.130.Final release that TuxCare onboarded, not backported by TuxCare. The vulnerable code pattern (decompression buffer allocation without any limit mechanism) has been replaced with code that provides the prepareDecompressBuffer() method to enforce configurable limits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11612" }, "impact_statement": "The target repository (Netty 4.1.130.Final-tuxcare.4) is NOT AFFECTED by CVE-2020-11612. The vulnerability (unbounded memory allocation in ZlibDecoders) was fixed in upstream Netty via commit 1543218d3e, which introduced configurable allocation limits through the maxAllocation parameter. This fix was already present in the upstream Netty 4.1.130.Final release that TuxCare onboarded, not backported by TuxCare. The vulnerable code pattern (decompression buffer allocation without any limit mechanism) has been replaced with code that provides the prepareDecompressBuffer() method to enforce configurable limits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler. CVE-2020-7238 affects Netty 4.1.43.Final (released 2019-10-24) due to HTTP Request Smuggling from mishandling Transfer-Encoding whitespace and conflicting Content-Length headers. The target version 4.1.130.Final-tuxcare.4 is not affected because the upstream fix (commit 8494b046ec by Norman Maurer, 2019-12-13) was already present in the upstream release when TuxCare onboarded it. The fix validates headers to reject multiple Content-Length headers and the combination of Content-Length + Transfer-Encoding: chunked in HTTP/1.1 messages, preventing request smuggling attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-7238" }, "impact_statement": "CVE-2020-7238 affects Netty 4.1.43.Final (released 2019-10-24) due to HTTP Request Smuggling from mishandling Transfer-Encoding whitespace and conflicting Content-Length headers. The target version 4.1.130.Final-tuxcare.4 is not affected because the upstream fix (commit 8494b046ec by Norman Maurer, 2019-12-13) was already present in the upstream release when TuxCare onboarded it. The fix validates headers to reject multiple Content-Length headers and the combination of Content-Length + Transfer-Encoding: chunked in HTTP/1.1 messages, preventing request smuggling attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2023-34462 affects version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2023-34462" }, "action_statement": "Vulnerability CVE-2023-34462 affects version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.130.Final-tuxcare.4.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-11-03T11:59:58.922832+00:00", "status_notes": "Vulnerability CVE-2025-24970 does not affect version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler. The target Netty 4.1.130.Final is NOT affected by CVE-2025-24970. The upstream fix for this vulnerability was already included in the 4.1.130.Final release before TuxCare onboarded it. The vulnerability involved missing validation of buffer size before reading SSL/TLS packet length fields, which could lead to native crashes. The fix (commits 87f40725 and dc6b051d) added early validation checks to ensure sufficient data is present before parsing, and this fix is present in all relevant code paths in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.91.Final, < 4.1.118.Final), NVD (>= 4.1.91, < 4.1.118), cve.org (>= 4.1.91.Final, <= 4.1.117.Final), Snyk (>= 4.1.91.Final, < 4.1.118.Final; >= 4.2.0.Alpha1, < 4.2.0.RC3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24970" }, "impact_statement": "The target Netty 4.1.130.Final is NOT affected by CVE-2025-24970. The upstream fix for this vulnerability was already included in the 4.1.130.Final release before TuxCare onboarded it. The vulnerability involved missing validation of buffer size before reading SSL/TLS packet length fields, which could lead to native crashes. The fix (commits 87f40725 and dc6b051d) added early validation checks to ensure sufficient data is present before parsing, and this fix is present in all relevant code paths in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.91.Final, < 4.1.118.Final), NVD (>= 4.1.91, < 4.1.118), cve.org (>= 4.1.91.Final, <= 4.1.117.Final), Snyk (>= 4.1.91.Final, < 4.1.118.Final; >= 4.2.0.Alpha1, < 4.2.0.RC3)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-44249" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-45416" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-50010" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75596" }, "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.130.Final-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.130.Final-tuxcare.4 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" } } ] }