{
  "@id": "urn:uuid:8e72c6f1-a55d-4477-b8a6-8a97ab2cca39",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T07:51:59.701187+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T18:12:19.286874+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x (before 3.9.2) where SSLv2Hello messages could cause infinite loops via repeated BUFFER_OVERFLOW status. The target (Netty 4.1.38.Final) is not affected because an upstream fix (commit fbe0e3506e7, Oct 2017) was already present in the 4.1.38.Final release before TuxCare onboarded it. The fix detects two consecutive BUFFER_OVERFLOW events with zero progress and th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x (before 3.9.2) where SSLv2Hello messages could cause infinite loops via repeated BUFFER_OVERFLOW status. The target (Netty 4.1.38.Final) is not affected because an upstream fix (commit fbe0e3506e7, Oct 2017) was already present in the 4.1.38.Final release before TuxCare onboarded it. The fix detects two consecutive BUFFER_OVERFLOW events with zero progress and th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:44:25.010068+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final due to an infinite loop in OpenSslEngine when SSL_write returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with no pending BIO data. The target version 4.1.38.Final already contains the upstream fix (commit 9e2c400f by Scott Mitchell) which was included in netty-4.1.1.Final. The vulnerable pattern is not present - ReferenceCountedOpenSslEngine.java properly returns control to the EventLoop instead of continuing to loop. This is an upstream fix that shipped in the release TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final due to an infinite loop in OpenSslEngine when SSL_write returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with no pending BIO data. The target version 4.1.38.Final already contains the upstream fix (commit 9e2c400f by Scott Mitchell) which was included in netty-4.1.1.Final. The vulnerable pattern is not present - ReferenceCountedOpenSslEngine.java properly returns control to the EventLoop instead of continuing to loop. This is an upstream fix that shipped in the release TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 Version 4.1.38.Final does not contain the vulnerable code path. The vulnerability exists in SslClientHelloHandler (introduced Feb 2020), which allocates a buffer based on a 3-byte handshake length field (up to 16MB). Version 4.1.38.Final (released July 2019) uses a different architecture where AbstractSniHandler parses ClientHello inline without separate buffer allocation, reading only 2-byte T...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.38.Final does not contain the vulnerable code path. The vulnerability exists in SslClientHelloHandler (introduced Feb 2020), which allocates a buffer based on a 3-byte handshake length field (up to 16MB). Version 4.1.38.Final (released July 2019) uses a different architecture where AbstractSniHandler parses ClientHello inline without separate buffer allocation, reading only 2-byte T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.38.Final-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:51:59.701187+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.38.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      },
      "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.38.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:51:59.701187+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.38.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.38.Final-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler. Version 4.1.38.Final is NOT AFFECTED by CVE-2026-45416. The vulnerable class SslClientHelloHandler does not exist in this version - it was introduced 6+ months later in February 2020 (commit 77effdc4da), while 4.1.38.Final was released in July 2019. This version uses AbstractSniHandler with a fundamentally different architecture: it processes TLS ClientHello inline without the multi-record buffering mechanism that contains the vulnerability. The vulnerable pattern (reading 24-bit handshake length and eagerly allocating ctx.alloc().buffer(handshakeLength) up to 16MB) is absent. AbstractSniHandler in 4.1.38.Final only reads the 16-bit TLS record length (max ~16KB per RFC) and performs no buffer allocations in its decode() method. The INPUT (TLS ClientHello) is received, but no code path reaches the GOAL (excessive memory allocation based on attacker-controlled handshake length). This satisfies Rule 5 Type A2: chain absent due to missing SslClientHelloHandler buffering mechanism.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "impact_statement": "Version 4.1.38.Final is NOT AFFECTED by CVE-2026-45416. The vulnerable class SslClientHelloHandler does not exist in this version - it was introduced 6+ months later in February 2020 (commit 77effdc4da), while 4.1.38.Final was released in July 2019. This version uses AbstractSniHandler with a fundamentally different architecture: it processes TLS ClientHello inline without the multi-record buffering mechanism that contains the vulnerability. The vulnerable pattern (reading 24-bit handshake length and eagerly allocating ctx.alloc().buffer(handshakeLength) up to 16MB) is absent. AbstractSniHandler in 4.1.38.Final only reads the 16-bit TLS record length (max ~16KB per RFC) and performs no buffer allocations in its decode() method. The INPUT (TLS ClientHello) is received, but no code path reaches the GOAL (excessive memory allocation based on attacker-controlled handshake length). This satisfies Rule 5 Type A2: chain absent due to missing SslClientHelloHandler buffering mechanism."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler. Version 4.1.38.Final is not affected by CVE-2026-75596. The vulnerability exists in SslClientHelloHandler's quadratic re-aggregation of fragmented ClientHello messages (handshakeBuffer.clear() + writeBytes() pattern causing O(n\u00b2) CPU consumption). This class was introduced on Feb 5, 2020 via PR #9827, approximately 6 months after version 4.1.38.Final was released (July 24, 2019). The target version uses AbstractSniHandler which parses ClientHello directly from the ByteToMessageDecoder cumulation buffer without creating intermediate buffers or performing repeated copying, eliminating the attack path to quadratic CPU exhaustion. No CVE-2026-75596 backports exist for versions older than 4.1.119.Final, confirming that pre-SslClientHelloHandler versions are not vulnerable.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "impact_statement": "Version 4.1.38.Final is not affected by CVE-2026-75596. The vulnerability exists in SslClientHelloHandler's quadratic re-aggregation of fragmented ClientHello messages (handshakeBuffer.clear() + writeBytes() pattern causing O(n\u00b2) CPU consumption). This class was introduced on Feb 5, 2020 via PR #9827, approximately 6 months after version 4.1.38.Final was released (July 24, 2019). The target version uses AbstractSniHandler which parses ClientHello directly from the ByteToMessageDecoder cumulation buffer without creating intermediate buffers or performing repeated copying, eliminating the attack path to quadratic CPU exhaustion. No CVE-2026-75596 backports exist for versions older than 4.1.119.Final, confirming that pre-SslClientHelloHandler versions are not vulnerable."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.38.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:05:23.387008+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.38.Final-tuxcare.1 of io.netty:netty-handler."
    }
  ]
}