{ "@id": "urn:uuid:81792a42-e731-4fd2-80de-02c9aa49fdaa", "role": "Document Creator", "author": "https://tuxcare.com", "version": 22, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T14:10:02.605335+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T17:58:00.046882+00:00", "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 Netty 4.1.80.Final is not affected by CVE-2014-3488. The vulnerability affected Netty 3.x before 3.9.2, where crafted SSLv2Hello messages could cause infinite loops and CPU consumption due to inadequate BUFFER_OVERFLOW handling during SSL handshakes. Netty 4.x uses a different architecture and has had proper BUFFER_OVERFLOW handling in SslHandler since its June 2012 rewrite (commit 50fafdc3d3)....", "vulnerability": { "name": "CVE-2014-3488" }, "impact_statement": "not_affected \u2014 Netty 4.1.80.Final is not affected by CVE-2014-3488. The vulnerability affected Netty 3.x before 3.9.2, where crafted SSLv2Hello messages could cause infinite loops and CPU consumption due to inadequate BUFFER_OVERFLOW handling during SSL handshakes. Netty 4.x uses a different architecture and has had proper BUFFER_OVERFLOW handling in SslHandler since its June 2012 rewrite (commit 50fafdc3d3)...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T12:28:48.622691+00:00", "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version is 4.1.80.Final, which is significantly newer than the affected range. The vulnerability (infinite loop when SSL_write returns SSL_ERROR_WANT_READ with empty BIO buffer) was fixed by upstream Netty in 2016. The fix was carried forward during a refactoring when OpenSslEngine logic was moved to ReferenceCountedOpenSslEngine. The current code correctly returns to the event loop instead of continuing to loop. The fix was authored by Scott Mitchell (scott_mitchell@apple.com) and shipped in upstream Netty 4.1.5.Final, which predates the 4.1.80.Final release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4970" }, "impact_statement": "CVE-2016-4970 affects Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. The target version is 4.1.80.Final, which is significantly newer than the affected range. The vulnerability (infinite loop when SSL_write returns SSL_ERROR_WANT_READ with empty BIO buffer) was fixed by upstream Netty in 2016. The fix was carried forward during a refactoring when OpenSslEngine logic was moved to ReferenceCountedOpenSslEngine. The current code correctly returns to the event loop instead of continuing to loop. The fix was authored by Scott Mitchell (scott_mitchell@apple.com) and shipped in upstream Netty 4.1.5.Final, which predates the 4.1.80.Final release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2" } } ], "timestamp": "2026-11-04T09:05:53.304095+00:00", "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler. CVE-2020-11612 describes unbounded memory allocation in Netty's ZlibDecoders when processing compressed byte streams. The target repository (Netty 4.1.80.Final-tuxcare.4) contains the upstream fix that adds optional maxAllocation limits to prevent unbounded buffer growth. The fix (commit 1543218d3e7afcb33a90b728b14370395a3deca0 by Rich DiCroce) shipped in upstream Netty 4.1.46 and was included in the 4.1.80.Final release that TuxCare onboarded. The defense code exists in ZlibDecoder.java (lines 33, 48-50, 62-84), JZlibDecoder.java (constructors with maxAllocation parameter, usage at lines 154, 158), and JdkZlibDecoder.java (constructors with maxAllocation parameter, usage at lines 235, 265). However, the defense defaults to maxAllocation=0 (no limit) for backward compatibility, requiring applications to explicitly configure a limit to activate the protection. Verdict: not_affected with justification requires_configuration (defense present but needs configuration).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).", "vulnerability": { "name": "CVE-2020-11612" }, "impact_statement": "CVE-2020-11612 describes unbounded memory allocation in Netty's ZlibDecoders when processing compressed byte streams. The target repository (Netty 4.1.80.Final-tuxcare.4) contains the upstream fix that adds optional maxAllocation limits to prevent unbounded buffer growth. The fix (commit 1543218d3e7afcb33a90b728b14370395a3deca0 by Rich DiCroce) shipped in upstream Netty 4.1.46 and was included in the 4.1.80.Final release that TuxCare onboarded. The defense code exists in ZlibDecoder.java (lines 33, 48-50, 62-84), JZlibDecoder.java (constructors with maxAllocation parameter, usage at lines 154, 158), and JdkZlibDecoder.java (constructors with maxAllocation parameter, usage at lines 235, 265). However, the defense defaults to maxAllocation=0 (no limit) for backward compatibility, requiring applications to explicitly configure a limit to activate the protection. Verdict: not_affected with justification requires_configuration (defense present but needs configuration).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2" } } ], "timestamp": "2026-11-06T18:29:00.082027+00:00", "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.80.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-7238" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.80.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2023-34462" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.80.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2025-24970" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-44249" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-45416 affects version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-45416" }, "action_statement": "Vulnerability CVE-2026-45416 affects version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.1.80.Final-tuxcare.2" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75596" }, "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.80.Final-tuxcare.2 of io.netty:netty-handler." } ] }