{
  "@id": "urn:uuid:5acc84d4-6db5-4904-b2a6-dc4c8058301e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 23,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T14:09:00.038715+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T18:02:00.053686+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 describes an infinite loop vulnerability in Netty 3.x SslHandler when processing SSLv2Hello messages. The target (Netty 4.1.87.Final) is not affected because: (1) Netty 4.x refactored the SSL handling architecture, replacing the fixed-size SslBufferPool with dynamic ByteBufAllocator-based allocation, and (2) the code contains explicit BUFFER_OVERFLOW handling (lines 1380-1392 in S...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 CVE-2014-3488 describes an infinite loop vulnerability in Netty 3.x SslHandler when processing SSLv2Hello messages. The target (Netty 4.1.87.Final) is not affected because: (1) Netty 4.x refactored the SSL handling architecture, replacing the fixed-size SslBufferPool with dynamic ByteBufAllocator-based allocation, and (2) the code contains explicit BUFFER_OVERFLOW handling (lines 1380-1392 in S..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:30:34.591989+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler. CVE-2016-4970 is NOT present in Netty 4.1.87.Final. The vulnerability involved an infinite loop in OpenSslEngine.wrap() when SSL_write returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with no data in the BIO buffer. The fix (commit 9e2c400f89) was already included in upstream Netty 4.1.1.Final (May 2016), well before the 4.1.87.Final release. The target code correctly returns control to the event loop instead of continuing the loop, preventing the DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 is NOT present in Netty 4.1.87.Final. The vulnerability involved an infinite loop in OpenSslEngine.wrap() when SSL_write returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE with no data in the BIO buffer. The fix (commit 9e2c400f89) was already included in upstream Netty 4.1.1.Final (May 2016), well before the 4.1.87.Final release. The target code correctly returns control to the event loop instead of continuing the loop, preventing the DoS condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler. CVE-2020-11612 is not present in Netty 4.1.87.Final. The vulnerability (unbounded memory allocation in ZlibDecoders) was fixed in upstream Netty 4.1.46.Final (released Feb 2020) via commit 1543218d by Rich DiCroce. The fix adds optional maxAllocation limits to ZlibDecoder/JZlibDecoder/JdkZlibDecoder and enforces them through prepareDecompressBuffer(). The target version 4.1.87.Final (onboarded by TuxCare in Sep 2026) already contains this upstream fix in its base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "CVE-2020-11612 is not present in Netty 4.1.87.Final. The vulnerability (unbounded memory allocation in ZlibDecoders) was fixed in upstream Netty 4.1.46.Final (released Feb 2020) via commit 1543218d by Rich DiCroce. The fix adds optional maxAllocation limits to ZlibDecoder/JZlibDecoder/JdkZlibDecoder and enforces them through prepareDecompressBuffer(). The target version 4.1.87.Final (onboarded by TuxCare in Sep 2026) already contains this upstream fix in its base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T18:31:00.049800+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.87.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.87.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:54.717747+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 affects version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.87.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "action_statement": "Vulnerability CVE-2023-34462 affects version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.87.Final-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T20:01:05.492962+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.87.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T20:01:05.492962+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T19:11:54.717747+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.87.Final-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler, and is fixed in 4.1.87.Final-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T20:01:05.492962+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T20:01:05.492962+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T20:01:05.492962+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.87.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T20:01:05.492962+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.87.Final-tuxcare.3 of io.netty:netty-handler."
    }
  ]
}