{ "@id": "urn:uuid:398b91ec-ef50-4976-8038-00432906aca0", "role": "Document Creator", "author": "https://tuxcare.com", "version": 19, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:05:51.407283+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-11-03T17:59:32.976663+00:00", "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 is not present in Netty 4.1.75.Final. The vulnerability (infinite loop when handling SSLv2Hello messages due to insufficient buffer allocation) was fixed in the upstream Netty project before the 4.1.75.Final release. The fix is present at SslHandler.java lines 1377-1390, where BUFFER_OVERFLOW status triggers allocation of a properly-sized buffer based on engine.getSession().getApp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3488" }, "impact_statement": "not_affected \u2014 CVE-2014-3488 is not present in Netty 4.1.75.Final. The vulnerability (infinite loop when handling SSLv2Hello messages due to insufficient buffer allocation) was fixed in the upstream Netty project before the 4.1.75.Final release. The fix is present at SslHandler.java lines 1377-1390, where BUFFER_OVERFLOW status triggers allocation of a properly-sized buffer based on engine.getSession().getApp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-11-03T12:28:48.622691+00:00", "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler. CVE-2016-4970 is NOT present in the target. The vulnerability affected Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version 4.1.75.Final includes the upstream fix from commit 9e2c400f89 (authored by scott_mitchell@apple.com, shipped in netty-4.1.1.Final). The vulnerable code pattern (break statement allowing infinite loop on SSL_ERROR_WANT_READ/WRITE in wrap()) has been replaced with return statements that properly exit to the event loop. While the implementation has been refactored from OpenSslEngine to ReferenceCountedOpenSslEngine, the fix behavior is preserved.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4970" }, "impact_statement": "CVE-2016-4970 is NOT present in the target. The vulnerability affected Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version 4.1.75.Final includes the upstream fix from commit 9e2c400f89 (authored by scott_mitchell@apple.com, shipped in netty-4.1.1.Final). The vulnerable code pattern (break statement allowing infinite loop on SSL_ERROR_WANT_READ/WRITE in wrap()) has been replaced with return statements that properly exit to the event loop. While the implementation has been refactored from OpenSslEngine to ReferenceCountedOpenSslEngine, the fix behavior is preserved.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-11-04T09:07:59.808671+00:00", "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler. CVE-2020-11612 is not affecting this target. The vulnerability allows unbounded memory allocation during Zlib decompression, potentially exhausting server memory. The fix (adding configurable maxAllocation limit to ZlibDecoder classes) was introduced in upstream Netty commit 1543218d3e7afcb33a90b728b14370395a3deca0 by Rich DiCroce and shipped in Netty 4.1.46. This target (version 4.1.75.Final-tuxcare.5) already contains the fix from the upstream release. The defense code exists in all three decoder classes (ZlibDecoder, JZlibDecoder, JdkZlibDecoder) but is disabled by default (maxAllocation=0 means no limit). Users must explicitly configure maxAllocation>0 to enable protection, hence justification is requires_configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).", "vulnerability": { "name": "CVE-2020-11612" }, "impact_statement": "CVE-2020-11612 is not affecting this target. The vulnerability allows unbounded memory allocation during Zlib decompression, potentially exhausting server memory. The fix (adding configurable maxAllocation limit to ZlibDecoder classes) was introduced in upstream Netty commit 1543218d3e7afcb33a90b728b14370395a3deca0 by Rich DiCroce and shipped in Netty 4.1.46. This target (version 4.1.75.Final-tuxcare.5) already contains the fix from the upstream release. The defense code exists in all three decoder classes (ZlibDecoder, JZlibDecoder, JdkZlibDecoder) but is disabled by default (maxAllocation=0 means no limit). Users must explicitly configure maxAllocation>0 to enable protection, hence justification is requires_configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-11-06T18:30:00.096687+00:00", "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.75.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-7238" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.75.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2023-34462" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.75.Final-tuxcare.5.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2025-24970" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-44249" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-45416" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-50010" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75596" }, "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.75.Final-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" }, "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.75.Final-tuxcare.5 of io.netty:netty-handler." } ] }