{
  "@id": "urn:uuid:3d30fa09-fb58-4892-89d0-b73c6b098628",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects \"Netty before 3.9.2\" (Netty 3.x only), where a fixed-size buffer pool caused infinite BUFFER_OVERFLOW loops when processing SSLv2Hello messages requiring >30KB application buffers. The target (Netty 4.1.49.Final-tuxcare.6) was never vulnerable. Netty 4.x has used dynamic buffer allocation based on engine.getSession().getApplicationBufferSize() since its initial SslHandler ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects \"Netty before 3.9.2\" (Netty 3.x only), where a fixed-size buffer pool caused infinite BUFFER_OVERFLOW loops when processing SSLv2Hello messages requiring >30KB application buffers. The target (Netty 4.1.49.Final-tuxcare.6) was never vulnerable. Netty 4.x has used dynamic buffer allocation based on engine.getSession().getApplicationBufferSize() since its initial SslHandler ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler. CVE-2016-4970 affects Netty versions 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version is 4.1.49.Final, which is significantly newer than the first fixed version (4.1.1.Final). The vulnerability involved an infinite loop when SSL_write returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer. The fix (commit 7d774584c8) was introduced by upstream contributor Scott Mitchell on July 14, 2016, and was already present in the upstream 4.1.49.Final release when TuxCare onboarded it. The target code correctly returns to the event loop with appropriate status instead of continuing the loop, preventing the infinite loop condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty versions 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version is 4.1.49.Final, which is significantly newer than the first fixed version (4.1.1.Final). The vulnerability involved an infinite loop when SSL_write returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer. The fix (commit 7d774584c8) was introduced by upstream contributor Scott Mitchell on July 14, 2016, and was already present in the upstream 4.1.49.Final release when TuxCare onboarded it. The target code correctly returns to the event loop with appropriate status instead of continuing the loop, preventing the infinite loop condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler. The target repository (Netty 4.1.49.Final-tuxcare.6) is NOT affected by CVE-2020-11612. The vulnerability (unbounded memory allocation during Zlib decompression) was fixed in upstream Netty 4.1.46.Final via commit 1543218d3e by Rich DiCroce. This fix was already present in Netty 4.1.49.Final when TuxCare onboarded it. The fix introduces an optional maxAllocation parameter to ZlibDecoder and its subclasses (JZlibDecoder, JdkZlibDecoder), along with a prepareDecompressBuffer() method that enforces buffer size limits and throws DecompressionException when exceeded. The vulnerable pattern (uncontrolled memory growth with no mitigation mechanism) is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "The target repository (Netty 4.1.49.Final-tuxcare.6) is NOT affected by CVE-2020-11612. The vulnerability (unbounded memory allocation during Zlib decompression) was fixed in upstream Netty 4.1.46.Final via commit 1543218d3e by Rich DiCroce. This fix was already present in Netty 4.1.49.Final when TuxCare onboarded it. The fix introduces an optional maxAllocation parameter to ZlibDecoder and its subclasses (JZlibDecoder, JdkZlibDecoder), along with a prepareDecompressBuffer() method that enforces buffer size limits and throws DecompressionException when exceeded. The vulnerable pattern (uncontrolled memory growth with no mitigation mechanism) is absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.49.Final-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler. not_affected \u2014 The target repository (Netty 4.1.49.Final-tuxcare.1) is not affected by CVE-2026-44249. The vulnerability exists in the IpSubnetFilterRule#compareTo(InetSocketAddress) method, which was introduced in version 4.1.52+ as part of a binary search optimization (PR #10492, merged September 2020). The target version predates this feature and uses a simpler matches() method that correctly applies the s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.49.Final-tuxcare.1) is not affected by CVE-2026-44249. The vulnerability exists in the IpSubnetFilterRule#compareTo(InetSocketAddress) method, which was introduced in version 4.1.52+ as part of a binary search optimization (PR #10492, merged September 2020). The target version predates this feature and uses a simpler matches() method that correctly applies the s..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.49.Final-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T12:27:06.016071+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.49.Final-tuxcare.7 of io.netty:netty-handler."
    }
  ]
}