{
  "@id": "urn:uuid:54f71395-f03c-4821-b01d-f6e3d451f781",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:51:00.040518+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T08:48:18.117175+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 describes an infinite loop in Netty 3.x SslHandler when processing SSLv2Hello messages that require buffers >30KB. The vulnerability occurred because Netty 3.x used a fixed-size SslBufferPool that couldn't provide adequate buffers, causing infinite BUFFER_OVERFLOW retry loops. The target (Netty 4.1.43.Final) is NOT AFFECTED because: (1) Netty 4.x architecturally eliminated the fix...",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 describes an infinite loop in Netty 3.x SslHandler when processing SSLv2Hello messages that require buffers >30KB. The vulnerability occurred because Netty 3.x used a fixed-size SslBufferPool that couldn't provide adequate buffers, causing infinite BUFFER_OVERFLOW retry loops. The target (Netty 4.1.43.Final) is NOT AFFECTED because: (1) Netty 4.x architecturally eliminated the fix..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T08:48:18.117175+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler. CVE-2016-4970 describes an infinite loop vulnerability in Netty's OpenSslEngine.wrap() method affecting versions before 4.1.1.Final. The target is version 4.1.43.Final (released long after the fix). The vulnerable code pattern is NOT present in the target. When SSL_write returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer, the current implementation immediately returns from the method (ReferenceCountedOpenSslEngine.java lines 902, 916), breaking out of all loops and returning control to the event loop. This prevents the infinite loop that caused denial of service in older versions. The upstream 4.1.43.Final release that TuxCare onboarded already contained this protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 describes an infinite loop vulnerability in Netty's OpenSslEngine.wrap() method affecting versions before 4.1.1.Final. The target is version 4.1.43.Final (released long after the fix). The vulnerable code pattern is NOT present in the target. When SSL_write returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer, the current implementation immediately returns from the method (ReferenceCountedOpenSslEngine.java lines 902, 916), breaking out of all loops and returning control to the event loop. This prevents the infinite loop that caused denial of service in older versions. The upstream 4.1.43.Final release that TuxCare onboarded already contained this protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T08:48:18.117175+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T08:48:18.117175+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T08:49:00.067110+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 is fixed in version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T08:48:18.117175+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T08:48:18.117175+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.43.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T08:48:18.117175+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T08:48:18.117175+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T08:48:18.117175+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler. Version 4.1.43.Final is not affected by CVE-2026-45416. The vulnerability requires SslClientHelloHandler, which was introduced in February 2020 (commit #9827), four months after 4.1.43.Final was released (October 2019). The target's AbstractSniHandler extends ByteToMessageDecoder and processes ClientHello in-place without eager buffer allocation. The architectural change that introduced the vulnerable pattern (AbstractSniHandler extending SslClientHelloHandler with eager buffer allocation based on handshake length) occurred after this version. The vulnerable code pattern is absent in 4.1.43.Final.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "impact_statement": "Version 4.1.43.Final is not affected by CVE-2026-45416. The vulnerability requires SslClientHelloHandler, which was introduced in February 2020 (commit #9827), four months after 4.1.43.Final was released (October 2019). The target's AbstractSniHandler extends ByteToMessageDecoder and processes ClientHello in-place without eager buffer allocation. The architectural change that introduced the vulnerable pattern (AbstractSniHandler extending SslClientHelloHandler with eager buffer allocation based on handshake length) occurred after this version. The vulnerable code pattern is absent in 4.1.43.Final."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T08:49:00.067110+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T08:48:18.117175+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T08:48:18.117175+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.43.Final-tuxcare.5 of io.netty:netty-handler. Netty 4.1.43.Final is not affected by CVE-2026-75596. The vulnerable code (SslClientHelloHandler with quadratic ClientHello fragment aggregation) was introduced in version 4.1.44+ (February 2020), approximately 3.5 months AFTER the 4.1.43.Final release (October 2019). The target version uses AbstractSniHandler which does not implement multi-record ClientHello aggregation and therefore cannot exhibit the quadratic re-copying behavior described in the CVE.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "impact_statement": "Netty 4.1.43.Final is not affected by CVE-2026-75596. The vulnerable code (SslClientHelloHandler with quadratic ClientHello fragment aggregation) was introduced in version 4.1.44+ (February 2020), approximately 3.5 months AFTER the 4.1.43.Final release (October 2019). The target version uses AbstractSniHandler which does not implement multi-record ClientHello aggregation and therefore cannot exhibit the quadratic re-copying behavior described in the CVE."
    }
  ]
}