{
  "@id": "urn:uuid:0cf6834b-72f5-4d8e-936a-38fcdc7c04f7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T19:31:16.156682+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T19:52:29.846723+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affected Netty 3.x versions before 3.9.2, where SslHandler could enter an infinite loop when processing SSLv2Hello messages due to inadequate buffer allocation on BUFFER_OVERFLOW. The target (Netty 4.1.68.Final) is not affected because the upstream Netty 4.x rewrite in June 2012 (commit 50fafdc3d3) implemented proper BUFFER_OVERFLOW handling that allocates buffers based on engine....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affected Netty 3.x versions before 3.9.2, where SslHandler could enter an infinite loop when processing SSLv2Hello messages due to inadequate buffer allocation on BUFFER_OVERFLOW. The target (Netty 4.1.68.Final) is not affected because the upstream Netty 4.x rewrite in June 2012 (commit 50fafdc3d3) implemented proper BUFFER_OVERFLOW handling that allocates buffers based on engine...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T19:52:29.846723+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version 4.1.68.Final contains the upstream vendor fix (commit 9e2c400f89) that was introduced in Netty 4.1.1.Final on 2016-05-27. The fix prevents infinite loops in OpenSslEngine by ensuring that when SSL_write returns SSL_ERROR_WANT_READ with an empty BIO buffer, the code returns to the event loop instead of continuing to loop. Code verification confirms the fix is present in ReferenceCountedOpenSslEngine.java:958-962. The fix was authored by Scott Mitchell (upstream Netty) and shipped in the upstream 4.1.68.Final release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version 4.1.68.Final contains the upstream vendor fix (commit 9e2c400f89) that was introduced in Netty 4.1.1.Final on 2016-05-27. The fix prevents infinite loops in OpenSslEngine by ensuring that when SSL_write returns SSL_ERROR_WANT_READ with an empty BIO buffer, the code returns to the event loop instead of continuing to loop. Code verification confirms the fix is present in ReferenceCountedOpenSslEngine.java:958-962. The fix was authored by Scott Mitchell (upstream Netty) and shipped in the upstream 4.1.68.Final release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T19:52:29.846723+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T19:52:29.846723+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler. CVE-2020-11612 affects Netty versions before 4.1.46. The target repository (Netty 4.1.68.Final-tuxcare.1) contains the complete fix that was released in upstream Netty 4.1.46.Final. The fix introduces a configurable maxAllocation limit on decompression buffers and a prepareDecompressBuffer() method that enforces this limit, preventing unbounded memory allocation during Zlib decompression. This fix was authored by Rich DiCroce and merged into upstream in January 2020 (commit 1543218d3e), 44 commits before the 4.1.46.Final release. When TuxCare onboarded version 4.1.68.Final in October 2026, the fix was already present in the upstream release. The target is not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 affects Netty versions before 4.1.46. The target repository (Netty 4.1.68.Final-tuxcare.1) contains the complete fix that was released in upstream Netty 4.1.46.Final. The fix introduces a configurable maxAllocation limit on decompression buffers and a prepareDecompressBuffer() method that enforces this limit, preventing unbounded memory allocation during Zlib decompression. This fix was authored by Rich DiCroce and merged into upstream in January 2020 (commit 1543218d3e), 44 commits before the 4.1.46.Final release. When TuxCare onboarded version 4.1.68.Final in October 2026, the fix was already present in the upstream release. The target is not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T19:52:29.846723+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.68.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.68.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T19:52:29.846723+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T19:52:29.846723+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.68.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T19:52:29.846723+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T19:52:29.846723+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T19:52:29.846723+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T19:52:29.846723+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-13T19:31:16.156682+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.68.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.68.Final-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.68.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T19:52:29.846723+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.68.Final-tuxcare.3 of io.netty:netty-handler."
    }
  ]
}