{
  "@id": "urn:uuid:602f1022-b04a-488e-b854-6f6ba6eeec74",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T10:40:00.052338+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T10:55:20.558550+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x before 3.9.2, where SSLv2Hello messages could cause an infinite loop due to inadequate BUFFER_OVERFLOW handling. The target (Netty 4.1.81.Final) is not affected because the BUFFER_OVERFLOW defense has been present in Netty 4.x since the 2012 SslHandler rewrite. The code properly allocates larger buffers when needed, preventing the infinite loop condition. This is...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x before 3.9.2, where SSLv2Hello messages could cause an infinite loop due to inadequate BUFFER_OVERFLOW handling. The target (Netty 4.1.81.Final) is not affected because the BUFFER_OVERFLOW defense has been present in Netty 4.x since the 2012 SslHandler rewrite. The code properly allocates larger buffers when needed, preventing the infinite loop condition. This is..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T10:55:20.558550+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler. CVE-2016-4970 affects Netty versions before 4.0.37.Final and 4.1.1.Final due to an infinite loop when OpenSslEngine.wrap() receives SSL_ERROR_WANT_READ/WANT_WRITE with no pending BIO data. The target version 4.1.81.Final (released August 2022) already contains the upstream fix introduced in February 2017. The vulnerable pattern is not present - the code correctly returns to the event loop instead of continuing to iterate.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty versions before 4.0.37.Final and 4.1.1.Final due to an infinite loop when OpenSslEngine.wrap() receives SSL_ERROR_WANT_READ/WANT_WRITE with no pending BIO data. The target version 4.1.81.Final (released August 2022) already contains the upstream fix introduced in February 2017. The vulnerable pattern is not present - the code correctly returns to the event loop instead of continuing to iterate.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T10:55:20.558550+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T10:55:20.558550+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler. CVE-2020-11612 does not affect this version of Netty (4.1.81.Final). The upstream fix adding the maxAllocation parameter to ZlibDecoders was already present in version 4.1.81.Final when TuxCare onboarded it. The fix was originally committed on 2020-01-31 by Rich DiCroce (commit 1543218d3e) and was included in Netty 4.1.46, well before version 4.1.81. The defense mechanism exists in the codebase but requires explicit configuration (setting maxAllocation > 0) to activate the decompression buffer size limit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 does not affect this version of Netty (4.1.81.Final). The upstream fix adding the maxAllocation parameter to ZlibDecoders was already present in version 4.1.81.Final when TuxCare onboarded it. The fix was originally committed on 2020-01-31 by Rich DiCroce (commit 1543218d3e) and was included in Netty 4.1.46, well before version 4.1.81. The defense mechanism exists in the codebase but requires explicit configuration (setting maxAllocation > 0) to activate the decompression buffer size limit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T10:55:20.558550+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.81.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.81.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-13T10:40:00.052338+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.81.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "action_statement": "Vulnerability CVE-2023-34462 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.81.Final-tuxcare.6."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T10:55:20.558550+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.81.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T10:55:20.558550+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T10:55:20.558550+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T10:55:20.558550+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "action_statement": "Vulnerability CVE-2026-45416 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T10:55:20.558550+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-13T10:40:00.052338+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.81.Final-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.81.Final-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T10:55:20.558550+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T10:55:20.558550+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.81.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T10:55:20.558550+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.81.Final-tuxcare.3 of io.netty:netty-handler."
    }
  ]
}