{ "@id": "urn:uuid:daefdbc7-88af-4246-b553-555c9a149de6", "role": "Document Creator", "author": "https://tuxcare.com", "version": 5, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:05:51.407283+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T18:06:04.014241+00:00", "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x < 3.9.2, where SslHandler used a fixed-size buffer from SslBufferPool that caused infinite loops when processing SSLv2Hello messages requiring large application buffers. The target (Netty 4.1.29.Final-tuxcare.3) uses fundamentally different architecture: Netty 4.x replaced SslBufferPool with ByteBufAllocator for dynamic buffer allocation, eliminating the vulnerab...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3488" }, "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x < 3.9.2, where SslHandler used a fixed-size buffer from SslBufferPool that caused infinite loops when processing SSLv2Hello messages requiring large application buffers. The target (Netty 4.1.29.Final-tuxcare.3) uses fundamentally different architecture: Netty 4.x replaced SslBufferPool with ByteBufAllocator for dynamic buffer allocation, eliminating the vulnerab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T13:49:39.156684+00:00", "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final. The target version 4.1.29.Final already contains the fix in the upstream release. The vulnerability was an infinite loop when SSL_write returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer. The vulnerable code would break and continue the loop instead of returning to the event loop. The fix was introduced in May 2016 (commit 524156f) and carried forward during a July 2016 refactoring (commit 7d774584c8) that moved the implementation from OpenSslEngine.java to ReferenceCountedOpenSslEngine.java. The upstream 4.1.29.Final release already contained this fix when TuxCare onboarded it. The current code at ReferenceCountedOpenSslEngine.java:780-798 properly returns from the method with appropriate SSLEngineResult values instead of continuing the loop, preventing the infinite loop condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4970" }, "impact_statement": "CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final. The target version 4.1.29.Final already contains the fix in the upstream release. The vulnerability was an infinite loop when SSL_write returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer. The vulnerable code would break and continue the loop instead of returning to the event loop. The fix was introduced in May 2016 (commit 524156f) and carried forward during a July 2016 refactoring (commit 7d774584c8) that moved the implementation from OpenSslEngine.java to ReferenceCountedOpenSslEngine.java. The upstream 4.1.29.Final release already contained this fix when TuxCare onboarded it. The current code at ReferenceCountedOpenSslEngine.java:780-798 properly returns from the method with appropriate SSLEngineResult values instead of continuing the loop, preventing the infinite loop condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T13:49:39.156684+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T13:49:39.156684+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T13:49:39.156684+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T13:49:39.156684+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 Netty version 4.1.29.Final is NOT AFFECTED by CVE-2023-34462. The vulnerability exists in a refactored architecture introduced between versions 4.1.29.Final (Sept 2018) and 4.1.50.Final (June 2020). The target version uses an older architecture where ClientHello parsing is performed in-place without the multi-record accumulation feature that enables the 16MB buffer allocation attack. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Netty version 4.1.29.Final is NOT AFFECTED by CVE-2023-34462. The vulnerability exists in a refactored architecture introduced between versions 4.1.29.Final (Sept 2018) and 4.1.50.Final (June 2020). The target version uses an older architecture where ClientHello parsing is performed in-place without the multi-record accumulation feature that enables the 16MB buffer allocation attack. The vulner..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T13:49:39.156684+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.29.Final-tuxcare.3.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3" } } ], "timestamp": "2026-11-04T07:09:00.054110+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.29.Final-tuxcare.4.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.29.Final-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T13:49:39.156684+00:00", "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler. CVE-2026-44249 describes a vulnerability in the IpSubnetFilterRule.compareTo(InetSocketAddress) method that incorrectly uses networkAddress instead of subnetMask for bitwise AND operations. Version 4.1.29.Final does NOT have this compareTo method (different architecture - the class only implements IpFilterRule, not Comparable). The actual filtering in this version is performed by the matches() method (line 156) which CORRECTLY uses subnetMask. While an unsigned BigInteger conversion issue exists at line 170 (not passing signum=1), this is a separate issue from the specific CVE-described bug. The CVE's attack chain (compareTo \u2192 wrong mask \u2192 bypass) does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44249" }, "impact_statement": "CVE-2026-44249 describes a vulnerability in the IpSubnetFilterRule.compareTo(InetSocketAddress) method that incorrectly uses networkAddress instead of subnetMask for bitwise AND operations. Version 4.1.29.Final does NOT have this compareTo method (different architecture - the class only implements IpFilterRule, not Comparable). The actual filtering in this version is performed by the matches() method (line 156) which CORRECTLY uses subnetMask. While an unsigned BigInteger conversion issue exists at line 170 (not passing signum=1), this is a separate issue from the specific CVE-described bug. The CVE's attack chain (compareTo \u2192 wrong mask \u2192 bypass) does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T13:49:39.156684+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler. Version 4.1.29.Final does not contain the vulnerable code pattern. The vulnerability requires SslClientHelloHandler, which was introduced after this version (git commit 8304069a30). The existing AbstractSniHandler only processes single-record ClientHello messages and never allocates buffers based on the 24-bit handshake length field. Multi-record ClientHello handling functionality is entirely absent from this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Version 4.1.29.Final does not contain the vulnerable code pattern. The vulnerability requires SslClientHelloHandler, which was introduced after this version (git commit 8304069a30). The existing AbstractSniHandler only processes single-record ClientHello messages and never allocates buffers based on the 24-bit handshake length field. Multi-record ClientHello handling functionality is entirely absent from this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3" } } ], "timestamp": "2026-11-05T10:33:15.957794+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.29.Final-tuxcare.5.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.29.Final-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T13:49:39.156684+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.29.Final-tuxcare.3" } } ], "timestamp": "2026-11-03T13:49:39.156684+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.29.Final-tuxcare.3 of io.netty:netty-handler. CVE-2026-75596 affects SslClientHelloHandler, a component introduced in Netty AFTER version 4.1.29.Final. The target uses AbstractSniHandler which does NOT aggregate ClientHello fragments across multiple TLS records and cannot exhibit the quadratic CPU vulnerability. The vulnerable code path with handshakeBuffer.clear() + writeBytes() re-copy pattern does not exist in this version. TuxCare backported the fix to versions 4.1.119.Final+ which have SslClientHelloHandler, but 4.1.29.Final never had the vulnerable component.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "CVE-2026-75596 affects SslClientHelloHandler, a component introduced in Netty AFTER version 4.1.29.Final. The target uses AbstractSniHandler which does NOT aggregate ClientHello fragments across multiple TLS records and cannot exhibit the quadratic CPU vulnerability. The vulnerable code path with handshakeBuffer.clear() + writeBytes() re-copy pattern does not exist in this version. TuxCare backported the fix to versions 4.1.119.Final+ which have SslClientHelloHandler, but 4.1.29.Final never had the vulnerable component." } ] }