{
  "@id": "urn:uuid:cc1a1d22-5412-40e8-9b62-dd2cd100597c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T14:09:00.038715+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T18:01:00.056889+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty before 3.9.2 and causes a denial of service via infinite loop when processing SSLv2Hello messages. The vulnerability occurs when SSLEngine requires a buffer larger than the pooled buffer size (>30KB for SSLv2Hello), causing BUFFER_OVERFLOW to repeat infinitely. The target repository (Netty 4.1.82.Final) is NOT AFFECTED because the upstream release already contains th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty before 3.9.2 and causes a denial of service via infinite loop when processing SSLv2Hello messages. The vulnerability occurs when SSLEngine requires a buffer larger than the pooled buffer size (>30KB for SSLv2Hello), causing BUFFER_OVERFLOW to repeat infinitely. The target repository (Netty 4.1.82.Final) is NOT AFFECTED because the upstream release already contains th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:29:43.002778+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler. CVE-2016-4970 affects Netty versions before 4.0.37.Final and 4.1.1.Final. The target is Netty 4.1.82.Final, which is 81 minor versions after the fix. The vulnerable code pattern (infinite loop when SSL_ERROR_WANT_READ/WANT_WRITE is returned with no BIO buffer data) is not present. The fix was already shipped in the upstream Netty 4.1.1.Final release and is present in the target's ReferenceCountedOpenSslEngine.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty versions before 4.0.37.Final and 4.1.1.Final. The target is Netty 4.1.82.Final, which is 81 minor versions after the fix. The vulnerable code pattern (infinite loop when SSL_ERROR_WANT_READ/WANT_WRITE is returned with no BIO buffer data) is not present. The fix was already shipped in the upstream Netty 4.1.1.Final release and is present in the target's ReferenceCountedOpenSslEngine.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler. The target repository Netty version 4.1.82.Final is NOT affected by CVE-2020-11612. The vulnerability concerns unbounded memory allocation in ZlibDecoders when processing compressed byte streams. The fix (commit 1543218d3e) that adds optional maxAllocation limits to prevent memory exhaustion was introduced in upstream Netty 4.1.46.Final and is already present in the target version 4.1.82.Final. All three ZlibDecoder classes (ZlibDecoder, JZlibDecoder, JdkZlibDecoder) contain the protection mechanism with maxAllocation field, prepareDecompressBuffer() method, and DecompressionException enforcement. This fix was authored by Rich.DiCroce@scientificgames.com and shipped in the upstream release that TuxCare onboarded, not applied as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "The target repository Netty version 4.1.82.Final is NOT affected by CVE-2020-11612. The vulnerability concerns unbounded memory allocation in ZlibDecoders when processing compressed byte streams. The fix (commit 1543218d3e) that adds optional maxAllocation limits to prevent memory exhaustion was introduced in upstream Netty 4.1.46.Final and is already present in the target version 4.1.82.Final. All three ZlibDecoder classes (ZlibDecoder, JZlibDecoder, JdkZlibDecoder) contain the protection mechanism with maxAllocation field, prepareDecompressBuffer() method, and DecompressionException enforcement. This fix was authored by Rich.DiCroce@scientificgames.com and shipped in the upstream release that TuxCare onboarded, not applied as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-06T18:30:00.096687+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.82.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.82.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-01T17:52:24.426616+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.82.Final-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "action_statement": "Vulnerability CVE-2023-34462 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler, and is fixed in 4.1.82.Final-tuxcare.8."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.82.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "action_statement": "Vulnerability CVE-2026-45416 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.82.Final-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      },
      "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.82.Final-tuxcare.4 of io.netty:netty-handler."
    }
  ]
}