{
  "@id": "urn:uuid:58e8c0cd-e631-470b-a924-139000015e6d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 20,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:03:00.046051+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T18:11:48.204695+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 describes an infinite loop DoS in Netty's SslHandler when processing SSLv2Hello messages due to insufficient buffer allocation causing repeated BUFFER_OVERFLOW status. The target (Netty 4.1.79.Final) contains the fix: BUFFER_OVERFLOW handling at SslHandler.java:1380-1391 that retrieves engine.getSession().getApplicationBufferSize() and allocates buffers of adequate capacity, preve...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 describes an infinite loop DoS in Netty's SslHandler when processing SSLv2Hello messages due to insufficient buffer allocation causing repeated BUFFER_OVERFLOW status. The target (Netty 4.1.79.Final) contains the fix: BUFFER_OVERFLOW handling at SslHandler.java:1380-1391 that retrieves engine.getSession().getApplicationBufferSize() and allocates buffers of adequate capacity, preve..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T12:44:53.933368+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final. The target version 4.1.79.Final already contains the upstream fix that prevents infinite loops in OpenSslEngine when SSL_write returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with no pending BIO data. The fix was shipped in upstream Netty release 4.1.1.Final (May 2016) and is present in the 4.1.79.Final release that TuxCare onboarded. The vulnerable pattern (loop continuation via break statement) is not present; the code properly returns control to the event loop via NEED_UNWRAP or BUFFER_OVERFLOW status.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final. The target version 4.1.79.Final already contains the upstream fix that prevents infinite loops in OpenSslEngine when SSL_write returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with no pending BIO data. The fix was shipped in upstream Netty release 4.1.1.Final (May 2016) and is present in the 4.1.79.Final release that TuxCare onboarded. The vulnerable pattern (loop continuation via break statement) is not present; the code properly returns control to the event loop via NEED_UNWRAP or BUFFER_OVERFLOW status.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-06T18:03:00.046051+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 does not affect version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler. Prechecker: The upstream fix is already in this version's source history (commits 5f688978, 62903462, 8494b046). The upstream fix was released in 4.1.45, and version 4.1.79.Final is a later release of the same line. Advisories: GitHub GHSA-p2v9-g2qv-p635 (fixed in 4.1.45), NVD (fixed in 4.1.44).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 5f688978, 62903462, 8494b046). The upstream fix was released in 4.1.45, and version 4.1.79.Final is a later release of the same line. Advisories: GitHub GHSA-p2v9-g2qv-p635 (fixed in 4.1.45), NVD (fixed in 4.1.44)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler. CVE-2020-11612 addresses unbounded memory allocation in Netty's ZlibDecoders. The target repository (Netty 4.1.79.Final-tuxcare.5) is NOT affected because the fix was already present in the upstream release netty-4.1.46.Final that TuxCare onboarded. The fix commit (1543218d3e) authored by Rich DiCroce adds a maxAllocation parameter to ZlibDecoder classes and implements prepareDecompressBuffer() to enforce buffer size limits, throwing DecompressionException when exceeded. Both JdkZlibDecoder and JZlibDecoder correctly use this defense mechanism. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 addresses unbounded memory allocation in Netty's ZlibDecoders. The target repository (Netty 4.1.79.Final-tuxcare.5) is NOT affected because the fix was already present in the upstream release netty-4.1.46.Final that TuxCare onboarded. The fix commit (1543218d3e) authored by Rich DiCroce adds a maxAllocation parameter to ZlibDecoder classes and implements prepareDecompressBuffer() to enforce buffer size limits, throwing DecompressionException when exceeded. Both JdkZlibDecoder and JZlibDecoder correctly use this defense mechanism. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-05T14:19:33.092775+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler. The upstream fix was released in 4.1.45, and version 4.1.79.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "The upstream fix was released in 4.1.45, and version 4.1.79.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-22T17:13:41.223423+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-22T17:13:41.223423+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.79.Final-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-22T17:13:41.223423+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-22T17:13:41.223423+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-22T17:13:41.223423+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-22T17:13:41.223423+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-22T17:13:41.223423+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-22T17:13:41.223423+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-22T17:13:41.223423+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.79.Final-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-22T17:13:41.223423+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.79.Final-tuxcare.5 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    }
  ]
}