{
  "@id": "urn:uuid:163b661c-fe44-464d-b19f-a3f8ae711f5b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T20:09:50.079453+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T06:49:02.730969+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 describes an infinite loop vulnerability in Netty 3.x SslHandler when processing SSLv2Hello messages that require large application buffers (>30KB). The target (Netty 4.1.52.Final) contains an upstream defense authored by Scott Mitchell in October 2017 that prevents this infinite loop. The defense detects when two consecutive BUFFER_OVERFLOW events occur without data consumption a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 describes an infinite loop vulnerability in Netty 3.x SslHandler when processing SSLv2Hello messages that require large application buffers (>30KB). The target (Netty 4.1.52.Final) contains an upstream defense authored by Scott Mitchell in October 2017 that prevents this infinite loop. The defense detects when two consecutive BUFFER_OVERFLOW events occur without data consumption a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T06:49:02.730969+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler. CVE-2016-4970 is not present in Netty 4.1.52.Final. The vulnerability was an infinite loop in OpenSslEngine.wrap() when SSL_write returned SSL_ERROR_WANT_READ with no data in the BIO buffer. The fix (commit 9e2c400f89) was authored by Scott Mitchell for upstream Netty and released in version 4.1.1.Final (June 2016). Target version 4.1.52.Final already contains this upstream fix, which was present before TuxCare's onboarding. The vulnerable code pattern has been removed - the current implementation in ReferenceCountedOpenSslEngine.java properly handles SSL_ERROR_WANT_READ by returning immediately with NEED_UNWRAP status instead of continuing to loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 is not present in Netty 4.1.52.Final. The vulnerability was an infinite loop in OpenSslEngine.wrap() when SSL_write returned SSL_ERROR_WANT_READ with no data in the BIO buffer. The fix (commit 9e2c400f89) was authored by Scott Mitchell for upstream Netty and released in version 4.1.1.Final (June 2016). Target version 4.1.52.Final already contains this upstream fix, which was present before TuxCare's onboarding. The vulnerable code pattern has been removed - the current implementation in ReferenceCountedOpenSslEngine.java properly handles SSL_ERROR_WANT_READ by returning immediately with NEED_UNWRAP status instead of continuing to loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T06:49:02.730969+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler. Target Netty 4.1.52.Final contains the upstream fix for CVE-2020-11612 (commit 1543218d3e). The fix adds maxAllocation parameter and prepareDecompressBuffer() method to ZlibDecoder and subclasses, preventing unbounded memory allocation during decompression. The defense mechanism exists in the code but defaults to disabled (maxAllocation=0 means unlimited); users must explicitly set maxAllocation > 0 to enable protection. The fix was authored by upstream contributor Rich.DiCroce@scientificgames.com and was already present in the 4.1.52.Final release when TuxCare onboarded it (fix commit is ancestor of first TuxCare commit 78670005b2). Not vulnerable per CVE scope (affects versions before 4.1.46).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "Target Netty 4.1.52.Final contains the upstream fix for CVE-2020-11612 (commit 1543218d3e). The fix adds maxAllocation parameter and prepareDecompressBuffer() method to ZlibDecoder and subclasses, preventing unbounded memory allocation during decompression. The defense mechanism exists in the code but defaults to disabled (maxAllocation=0 means unlimited); users must explicitly set maxAllocation > 0 to enable protection. The fix was authored by upstream contributor Rich.DiCroce@scientificgames.com and was already present in the 4.1.52.Final release when TuxCare onboarded it (fix commit is ancestor of first TuxCare commit 78670005b2). Not vulnerable per CVE scope (affects versions before 4.1.46).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T06:49:02.730969+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T06:49:02.730969+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T06:49:02.730969+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.52.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T06:49:02.730969+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T06:49:02.730969+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T06:50:01.761951+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T06:49:02.730969+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-13T20:09:50.079453+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler, and is fixed in 4.1.52.Final-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler, and is fixed in 4.1.52.Final-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T06:49:02.730969+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T06:49:02.730969+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.52.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T06:49:02.730969+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.52.Final-tuxcare.5 of io.netty:netty-handler."
    }
  ]
}