{
  "@id": "urn:uuid:1969e9af-2f8a-4adf-8d4f-42f831c711ad",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty before 3.9.2 and causes an infinite loop when processing SSLv2Hello messages due to insufficient buffer allocation. The target version 4.1.72.Final already contains the upstream fix that properly handles BUFFER_OVERFLOW by dynamically allocating appropriately sized buffers based on SSLEngine.getSession().getApplicationBufferSize(). The fix was introduced in Netty 4.x...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty before 3.9.2 and causes an infinite loop when processing SSLv2Hello messages due to insufficient buffer allocation. The target version 4.1.72.Final already contains the upstream fix that properly handles BUFFER_OVERFLOW by dynamically allocating appropriately sized buffers based on SSLEngine.getSession().getApplicationBufferSize(). The fix was introduced in Netty 4.x..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler. CVE-2016-4970 (infinite loop in OpenSslEngine) is NOT present in the target Netty 4.1.72.Final. The vulnerability affected versions before 4.1.1.Final, and the fix was already included in the upstream release 4.1.1.Final (May 2016) via commit 9e2c400f89 by Scott Mitchell. The target version 4.1.72.Final contains this upstream fix, which properly handles SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE to prevent infinite loops by returning control to the event loop instead of continuing to loop when there's no data in the BIO buffer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 (infinite loop in OpenSslEngine) is NOT present in the target Netty 4.1.72.Final. The vulnerability affected versions before 4.1.1.Final, and the fix was already included in the upstream release 4.1.1.Final (May 2016) via commit 9e2c400f89 by Scott Mitchell. The target version 4.1.72.Final contains this upstream fix, which properly handles SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE to prevent infinite loops by returning control to the event loop instead of continuing to loop when there's no data in the BIO buffer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler. The target repository (Netty 4.1.72.Final) contains the upstream fix for CVE-2020-11612. The fix was introduced in upstream Netty 4.1.46.Final via commit 1543218d3e and adds a maxAllocation parameter to ZlibDecoder and its subclasses to limit decompression buffer size. However, this protection defaults to 0 (unlimited) and requires explicit configuration to activate. Since this is an upstream fix that shipped in the release TuxCare onboarded (not a TuxCare backport), the verdict is not_affected with justification requires_configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "The target repository (Netty 4.1.72.Final) contains the upstream fix for CVE-2020-11612. The fix was introduced in upstream Netty 4.1.46.Final via commit 1543218d3e and adds a maxAllocation parameter to ZlibDecoder and its subclasses to limit decompression buffer size. However, this protection defaults to 0 (unlimited) and requires explicit configuration to activate. Since this is an upstream fix that shipped in the release TuxCare onboarded (not a TuxCare backport), the verdict is not_affected with justification requires_configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T18:30:00.096687+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.72.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.72.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.72.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.72.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:13:19.944795+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.72.Final-tuxcare.2 of io.netty:netty-handler."
    }
  ]
}