{
  "@id": "urn:uuid:ff23fc12-435e-44c1-988a-39cf7db09923",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x (before 3.9.2) where SSLv2Hello messages cause an infinite loop due to BUFFER_OVERFLOW being handled incorrectly. The target (Netty 4.1.53.Final) is not affected because this vulnerability pattern never existed in Netty 4.x. Since Netty 4's 2012 rewrite (commit 50fafdc3d3), SslHandler has properly handled BUFFER_OVERFLOW by querying engine.getSession().getApplica...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x (before 3.9.2) where SSLv2Hello messages cause an infinite loop due to BUFFER_OVERFLOW being handled incorrectly. The target (Netty 4.1.53.Final) is not affected because this vulnerability pattern never existed in Netty 4.x. Since Netty 4's 2012 rewrite (commit 50fafdc3d3), SslHandler has properly handled BUFFER_OVERFLOW by querying engine.getSession().getApplica..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version 4.1.53.Final is much newer than the fixed version (4.1.1.Final). The vulnerability was an infinite loop in OpenSslEngine when SSL_write() returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer. The upstream fix (commit 7d774584c8 by scott_mitchell@apple.com, July 2016) was already present when TuxCare onboarded version 4.1.53.Final (commit cc0d751b79, September 2020). The fix is in ReferenceCountedOpenSslEngine.java:922-945, properly returning to the event loop instead of continuing to loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version 4.1.53.Final is much newer than the fixed version (4.1.1.Final). The vulnerability was an infinite loop in OpenSslEngine when SSL_write() returned SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with an empty BIO buffer. The upstream fix (commit 7d774584c8 by scott_mitchell@apple.com, July 2016) was already present when TuxCare onboarded version 4.1.53.Final (commit cc0d751b79, September 2020). The fix is in ReferenceCountedOpenSslEngine.java:922-945, properly returning to the event loop instead of continuing to loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler. The target (Netty 4.1.53.Final) is not affected by CVE-2020-11612. The vulnerability affects Netty 4.1.x before 4.1.46, and the fix was already included in the upstream Netty 4.1.46 release. The target version 4.1.53.Final contains the complete upstream fix (commit 1543218d3e) which adds maxAllocation limits to ZlibDecoder and its subclasses, preventing unbounded memory allocation during decompression. The fix was authored by Rich DiCroce (scientificgames.com) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "The target (Netty 4.1.53.Final) is not affected by CVE-2020-11612. The vulnerability affects Netty 4.1.x before 4.1.46, and the fix was already included in the upstream Netty 4.1.46 release. The target version 4.1.53.Final contains the complete upstream fix (commit 1543218d3e) which adds maxAllocation limits to ZlibDecoder and its subclasses, preventing unbounded memory allocation during decompression. The fix was authored by Rich DiCroce (scientificgames.com) and shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.53.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.53.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-08T19:31:58.696721+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.53.Final-tuxcare.4 of io.netty:netty-handler."
    }
  ]
}