{
  "@id": "urn:uuid:03a7b385-9151-4688-a64b-8c023f54d16a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T10:08:03.616668+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T10:08:03.616668+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x (before 3.9.2) where SSLv2Hello messages cause infinite loop due to BUFFER_OVERFLOW. The target (Netty 4.1.23.Final-tuxcare.2) contains upstream fix fbe0e3506e from October 2017 that prevents infinite loops by detecting two consecutive BUFFER_OVERFLOW events with no progress and throwing IllegalStateException. This fix shipped in netty-4.1.17.Final and was includ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x (before 3.9.2) where SSLv2Hello messages cause infinite loop due to BUFFER_OVERFLOW. The target (Netty 4.1.23.Final-tuxcare.2) contains upstream fix fbe0e3506e from October 2017 that prevents infinite loops by detecting two consecutive BUFFER_OVERFLOW events with no progress and throwing IllegalStateException. This fix shipped in netty-4.1.17.Final and was includ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T10:08:03.616668+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler. CVE-2016-4970 affects Netty versions before 4.0.37.Final and 4.1.1.Final. The target version 4.1.23.Final already contains the upstream fix committed by Scott Mitchell (Apple) that prevents the infinite loop vulnerability. The fix was present in the upstream release before TuxCare onboarded this version. In the target code (ReferenceCountedOpenSslEngine.java:769-787), SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE are explicitly handled with return statements that pass control back to the event loop, preventing the infinite loop DoS condition described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty versions before 4.0.37.Final and 4.1.1.Final. The target version 4.1.23.Final already contains the upstream fix committed by Scott Mitchell (Apple) that prevents the infinite loop vulnerability. The fix was present in the upstream release before TuxCare onboarded this version. In the target code (ReferenceCountedOpenSslEngine.java:769-787), SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE are explicitly handled with return statements that pass control back to the event loop, preventing the infinite loop DoS condition described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T10:08:03.616668+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T10:08:03.616668+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T10:08:03.616668+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T10:08:03.616668+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler. not_affected \u2014 Version 4.1.23.Final does not contain the vulnerable code. CVE-2023-34462 affects the fragmented ClientHello handshake handling mechanism that allocates buffers up to 16MB based on the handshakeLength field. This vulnerable code was introduced in commit 29c471ec52 (November 29, 2019) and fixed in commit 535da17e45 (June 20, 2023). Target version 4.1.23.Final was released April 4, 2018\u20141 year an...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.23.Final does not contain the vulnerable code. CVE-2023-34462 affects the fragmented ClientHello handshake handling mechanism that allocates buffers up to 16MB based on the handshakeLength field. This vulnerable code was introduced in commit 29c471ec52 (November 29, 2019) and fixed in commit 535da17e45 (June 20, 2023). Target version 4.1.23.Final was released April 4, 2018\u20141 year an..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T10:08:03.616668+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.23.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T10:08:03.616668+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T10:08:03.616668+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T10:08:03.616668+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler. Target version 4.1.23.Final (April 2018) does not contain the vulnerable code. CVE-2026-45416 affects SslClientHelloHandler, which was introduced in Netty 4.1.46+ (February 2020), nearly 2 years after this release. The target uses AbstractSniHandler with a completely different architecture: it extends ByteToMessageDecoder (not SslClientHelloHandler), processes ClientHello in-place without buffer allocation, and handles only single TLS records (max 64KB each). The vulnerable pattern\u2014eagerly allocating ctx.alloc().buffer(handshakeLength) for multi-record ClientHello messages up to 16MB\u2014does not exist in this version. Type A2 analysis: Input (ClientHello) IS received, but the chain to Goal (unbounded allocations) is absent because the allocation step does not exist.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "impact_statement": "Target version 4.1.23.Final (April 2018) does not contain the vulnerable code. CVE-2026-45416 affects SslClientHelloHandler, which was introduced in Netty 4.1.46+ (February 2020), nearly 2 years after this release. The target uses AbstractSniHandler with a completely different architecture: it extends ByteToMessageDecoder (not SslClientHelloHandler), processes ClientHello in-place without buffer allocation, and handles only single TLS records (max 64KB each). The vulnerable pattern\u2014eagerly allocating ctx.alloc().buffer(handshakeLength) for multi-record ClientHello messages up to 16MB\u2014does not exist in this version. Type A2 analysis: Input (ClientHello) IS received, but the chain to Goal (unbounded allocations) is absent because the allocation step does not exist."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T10:08:03.616668+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T10:08:03.616668+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T10:08:03.616668+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-12T10:08:03.616668+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.23.Final-tuxcare.4 of io.netty:netty-handler."
    }
  ]
}