{
  "@id": "urn:uuid:144e6fa0-e284-449a-9f10-7ddf8cb43069",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T20:34:00.194551+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x (before 3.9.2) where SSLv2Hello messages cause infinite BUFFER_OVERFLOW loops. The target (Netty 4.1.46.Final) contains an upstream fix (commit fbe0e3506e7, shipped in Netty 4.1.17.Final) that prevents infinite BUFFER_OVERFLOW loops by detecting two consecutive overflows with no data consumption and throwing an exception. This defense, authored by Scott Mitchell ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x (before 3.9.2) where SSLv2Hello messages cause infinite BUFFER_OVERFLOW loops. The target (Netty 4.1.46.Final) contains an upstream fix (commit fbe0e3506e7, shipped in Netty 4.1.17.Final) that prevents infinite BUFFER_OVERFLOW loops by detecting two consecutive overflows with no data consumption and throwing an exception. This defense, authored by Scott Mitchell ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler. Target version 4.1.46.Final is not affected by CVE-2016-4970. The vulnerability (infinite loop in OpenSslEngine.wrap when SSL_write returns WANT_READ/WANT_WRITE with no BIO data) was fixed in upstream Netty 4.1.1.Final. The target version 4.1.46.Final, onboarded by TuxCare, already contains the upstream fix. The fix properly handles SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE by immediately returning control to the event loop instead of continuing the loop, preventing the DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "Target version 4.1.46.Final is not affected by CVE-2016-4970. The vulnerability (infinite loop in OpenSslEngine.wrap when SSL_write returns WANT_READ/WANT_WRITE with no BIO data) was fixed in upstream Netty 4.1.1.Final. The target version 4.1.46.Final, onboarded by TuxCare, already contains the upstream fix. The fix properly handles SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE by immediately returning control to the event loop instead of continuing the loop, preventing the DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler. CVE-2020-11612 affects Netty 4.1.x before 4.1.46, allowing unbounded memory allocation in ZlibDecoders. The target repository is Netty 4.1.46.Final, which contains the upstream fix. The fix adds a configurable maxAllocation limit to ZlibDecoder and its subclasses (JZlibDecoder, JdkZlibDecoder), enforced via the prepareDecompressBuffer method. This defense prevents unbounded buffer growth during decompression. The fix was authored by Rich DiCroce (Scientific Games) in commit 1543218d3e and shipped in upstream release 4.1.46.Final, which TuxCare onboarded. Not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 affects Netty 4.1.x before 4.1.46, allowing unbounded memory allocation in ZlibDecoders. The target repository is Netty 4.1.46.Final, which contains the upstream fix. The fix adds a configurable maxAllocation limit to ZlibDecoder and its subclasses (JZlibDecoder, JdkZlibDecoder), enforced via the prepareDecompressBuffer method. This defense prevents unbounded buffer growth during decompression. The fix was authored by Rich DiCroce (Scientific Games) in commit 1543218d3e and shipped in upstream release 4.1.46.Final, which TuxCare onboarded. Not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:50:00.057997+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.46.Final-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:50:00.057997+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:50:00.057997+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:50:00.057997+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:50:00.057997+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-13T20:34:00.194551+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.46.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.46.Final-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.46.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T18:48:34.594294+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.46.Final-tuxcare.1 of io.netty:netty-handler."
    }
  ]
}