{
  "@id": "urn:uuid:6e412ac1-2dbf-4b3e-9f2b-058f78cd1a75",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T18:07:54.173226+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x before 3.9.2, which used SslBufferPool with fixed-size buffers. When SSLv2Hello messages requiring >30KB buffers arrived, SSLEngine would repeatedly return BUFFER_OVERFLOW with no escape, causing an infinite loop. The target (Netty 4.1.60.Final) uses a fundamentally different architecture: ByteBufAllocator with dynamic sizing. Upstream commit fbe0e3506e77 (2017-1...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x before 3.9.2, which used SslBufferPool with fixed-size buffers. When SSLv2Hello messages requiring >30KB buffers arrived, SSLEngine would repeatedly return BUFFER_OVERFLOW with no escape, causing an infinite loop. The target (Netty 4.1.60.Final) uses a fundamentally different architecture: ByteBufAllocator with dynamic sizing. Upstream commit fbe0e3506e77 (2017-1..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:36:33.098195+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler. CVE-2016-4970 is NOT present in Netty 4.1.60.Final. The vulnerability (infinite loop DoS when SSL_write returns SSL_ERROR_WANT_READ/WANT_WRITE with empty BIO buffer) was fixed in upstream Netty 4.1.1.Final (June 2016). The target version 4.1.60.Final (March 2021) already contains the fix through commit d06990f434 which properly handles these error codes by returning control to the event loop instead of continuing the processing loop. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 is NOT present in Netty 4.1.60.Final. The vulnerability (infinite loop DoS when SSL_write returns SSL_ERROR_WANT_READ/WANT_WRITE with empty BIO buffer) was fixed in upstream Netty 4.1.1.Final (June 2016). The target version 4.1.60.Final (March 2021) already contains the fix through commit d06990f434 which properly handles these error codes by returning control to the event loop instead of continuing the processing loop. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler. CVE-2020-11612 is NOT present in Netty 4.1.60.Final. The vulnerability allowed unbounded memory allocation during Zlib decompression, but the fix (commit 1543218d3e) was already included in the upstream Netty 4.1.46 release (February 2020), which predates the 4.1.60.Final version that TuxCare onboarded. The fix adds a configurable maxAllocation parameter to ZlibDecoder and its subclasses (JZlibDecoder, JdkZlibDecoder), along with a prepareDecompressBuffer() method that enforces the limit and throws DecompressionException when reached. This defense mechanism is present and functional in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 is NOT present in Netty 4.1.60.Final. The vulnerability allowed unbounded memory allocation during Zlib decompression, but the fix (commit 1543218d3e) was already included in the upstream Netty 4.1.46 release (February 2020), which predates the 4.1.60.Final version that TuxCare onboarded. The fix adds a configurable maxAllocation parameter to ZlibDecoder and its subclasses (JZlibDecoder, JdkZlibDecoder), along with a prepareDecompressBuffer() method that enforces the limit and throws DecompressionException when reached. This defense mechanism is present and functional in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T03:28:09.355486+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.60.Final-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T20:29:00.061087+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.60.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.60.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T20:29:00.061087+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.60.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "action_statement": "Vulnerability CVE-2026-45416 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.60.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T20:29:00.061087+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.60.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler, and is fixed in 4.1.60.Final-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.60.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.60.Final-tuxcare.1 of io.netty:netty-handler."
    }
  ]
}