{
  "@id": "urn:uuid:8669a61e-6595-45dc-a599-c7f51ad75d79",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T18:31:00.029946+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T18:11:18.943331+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x (before 3.9.2) where SSLv2Hello messages caused infinite BUFFER_OVERFLOW loops due to inadequate buffer sizing. The target (Netty 4.1.24.Final) contains an upstream fix (commit fbe0e3506e, authored by scott_mitchell@apple.com, 2017-10-30) that prevents infinite loops by detecting two consecutive BUFFER_OVERFLOW events with zero data consumption and throwing an ex...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x (before 3.9.2) where SSLv2Hello messages caused infinite BUFFER_OVERFLOW loops due to inadequate buffer sizing. The target (Netty 4.1.24.Final) contains an upstream fix (commit fbe0e3506e, authored by scott_mitchell@apple.com, 2017-10-30) that prevents infinite loops by detecting two consecutive BUFFER_OVERFLOW events with zero data consumption and throwing an ex..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:43:21.485909+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler. CVE-2016-4970 is NOT present in Netty 4.1.24.Final. The vulnerability was an infinite loop in OpenSslEngine.wrap() when SSL_write returned SSL_ERROR_WANT_READ/WANT_WRITE with no data in the BIO buffer. The fix was released in upstream versions 4.0.37.Final and 4.1.1.Final in May 2016. The target version 4.1.24.Final (released April 2018) already contains the fix, which was shipped in the upstream release that TuxCare onboarded in September 2026. The vulnerable pattern is not present in the code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 is NOT present in Netty 4.1.24.Final. The vulnerability was an infinite loop in OpenSslEngine.wrap() when SSL_write returned SSL_ERROR_WANT_READ/WANT_WRITE with no data in the BIO buffer. The fix was released in upstream versions 4.0.37.Final and 4.1.1.Final in May 2016. The target version 4.1.24.Final (released April 2018) already contains the fix, which was shipped in the upstream release that TuxCare onboarded in September 2026. The vulnerable pattern is not present in the code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 Version 4.1.24.Final is NOT affected by CVE-2023-34462. The vulnerable code (handshakeBuffer allocation based on unchecked 3-byte handshake length) was introduced in version 4.1.44.Final (November 2019), over 18 months after 4.1.24.Final was released (April 2018). The target version parses ClientHello in-place without allocating buffers based on the attacker-controlled handshake length field, m...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.24.Final is NOT affected by CVE-2023-34462. The vulnerable code (handshakeBuffer allocation based on unchecked 3-byte handshake length) was introduced in version 4.1.44.Final (November 2019), over 18 months after 4.1.24.Final was released (April 2018). The target version parses ClientHello in-place without allocating buffers based on the attacker-controlled handshake length field, m..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.24.Final-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T07:31:00.032316+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.24.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      },
      "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.24.Final-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler. Version 4.1.24.Final is not affected by CVE-2026-44249. The vulnerable compareTo(InetSocketAddress) method described in the CVE was introduced in September 2020 (commit a49afaef35), more than 2 years after the release of 4.1.24.Final in April 2018. This version uses only the matches() method for IPv6 subnet filtering, which correctly applies the subnet mask. The binary search-based IpSubnetFilter class that relies on compareTo does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "impact_statement": "Version 4.1.24.Final is not affected by CVE-2026-44249. The vulnerable compareTo(InetSocketAddress) method described in the CVE was introduced in September 2020 (commit a49afaef35), more than 2 years after the release of 4.1.24.Final in April 2018. This version uses only the matches() method for IPv6 subnet filtering, which correctly applies the subnet mask. The binary search-based IpSubnetFilter class that relies on compareTo does not exist in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler. Version 4.1.24.Final does not contain the vulnerable SslClientHelloHandler class. CVE-2026-45416 concerns SslClientHelloHandler.decode() which eagerly allocates buffers based on attacker-controlled handshake length when maxClientHelloLength=0. However, SslClientHelloHandler was introduced in February 2020 (commit 8304069a30), almost 2 years after 4.1.24.Final was released in April 2018. The target version uses AbstractSniHandler with a fundamentally different implementation that processes ClientHello messages inline within the existing ByteBuf without allocating new buffers based on handshake length. The vulnerable code pattern (ctx.alloc().buffer(handshakeLength)) does not exist anywhere in the SSL handler code of this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "impact_statement": "Version 4.1.24.Final does not contain the vulnerable SslClientHelloHandler class. CVE-2026-45416 concerns SslClientHelloHandler.decode() which eagerly allocates buffers based on attacker-controlled handshake length when maxClientHelloLength=0. However, SslClientHelloHandler was introduced in February 2020 (commit 8304069a30), almost 2 years after 4.1.24.Final was released in April 2018. The target version uses AbstractSniHandler with a fundamentally different implementation that processes ClientHello messages inline within the existing ByteBuf without allocating new buffers based on handshake length. The vulnerable code pattern (ctx.alloc().buffer(handshakeLength)) does not exist anywhere in the SSL handler code of this version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T07:31:00.032316+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.24.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.24.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-13T18:31:00.029946+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.24.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.24.Final-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler. Netty 4.1.24.Final is NOT AFFECTED by CVE-2026-75596. The vulnerable code (SslClientHelloHandler with quadratic buffer re-aggregation) does not exist in this version. SslClientHelloHandler was introduced nearly 2 years after 4.1.24.Final's release (commit 8304069a30 on 2020-02-05 vs 04fac00c8c on 2018-04-19). The version uses AbstractSniHandler which parses ClientHello in-place without buffer re-copying, achieving O(n) complexity instead of the O(n\u00b2) behavior described in the CVE.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "impact_statement": "Netty 4.1.24.Final is NOT AFFECTED by CVE-2026-75596. The vulnerable code (SslClientHelloHandler with quadratic buffer re-aggregation) does not exist in this version. SslClientHelloHandler was introduced nearly 2 years after 4.1.24.Final's release (commit 8304069a30 on 2020-02-05 vs 04fac00c8c on 2018-04-19). The version uses AbstractSniHandler which parses ClientHello in-place without buffer re-copying, achieving O(n) complexity instead of the O(n\u00b2) behavior described in the CVE."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.24.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T09:46:43.826767+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler."
    }
  ]
}