{
  "@id": "urn:uuid:34602f3d-7a3c-4df0-a431-bbb09e9e1246",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:59:32.976663+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 The target repository (Netty 4.1.94.Final) is NOT affected by CVE-2014-3488. The vulnerability only affected Netty 3.x (before 3.9.2), where SslHandler could enter an infinite loop when processing SSLv2Hello messages requiring buffers larger than the pool capacity. Netty 4.x was completely rewritten in June 2012 by Trustin Lee with proper BUFFER_OVERFLOW handling from the start - two years befo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.94.Final) is NOT affected by CVE-2014-3488. The vulnerability only affected Netty 3.x (before 3.9.2), where SslHandler could enter an infinite loop when processing SSLv2Hello messages requiring buffers larger than the pool capacity. Netty 4.x was completely rewritten in June 2012 by Trustin Lee with proper BUFFER_OVERFLOW handling from the start - two years befo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:28:48.622691+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler. CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final. The target version 4.1.94.Final already contains the upstream fix from 2017 that prevents the infinite loop condition. The vulnerable pattern (breaking from switch on SSL_ERROR_WANT_READ/WANT_WRITE and continuing to loop) is not present in the target code. Instead, the code properly returns to the event loop with NEED_UNWRAP or BUFFER_OVERFLOW status codes when SSL operations require more data but the BIO buffer is empty. This fix was authored by upstream Netty developers (Scott Mitchell, scott_mitchell@apple.com) and shipped in version 4.1.1.Final, well before TuxCare onboarded version 4.1.94.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "impact_statement": "CVE-2016-4970 affects Netty 4.1.x before 4.1.1.Final. The target version 4.1.94.Final already contains the upstream fix from 2017 that prevents the infinite loop condition. The vulnerable pattern (breaking from switch on SSL_ERROR_WANT_READ/WANT_WRITE and continuing to loop) is not present in the target code. Instead, the code properly returns to the event loop with NEED_UNWRAP or BUFFER_OVERFLOW status codes when SSL operations require more data but the BIO buffer is empty. This fix was authored by upstream Netty developers (Scott Mitchell, scott_mitchell@apple.com) and shipped in version 4.1.1.Final, well before TuxCare onboarded version 4.1.94.Final.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler. The target repository (Netty 4.1.94.Final-tuxcare.2) is NOT AFFECTED by CVE-2020-11612. The vulnerability describes unbounded memory allocation in ZlibDecoders for versions before 4.1.46. The fix mechanism (maxAllocation parameter with prepareDecompressBuffer enforcement) was introduced in upstream commit 1543218d3e (included in Netty 4.1.46.Final, Jan 2020) and is present in the target version. The defense code exists in ZlibDecoder.java, JZlibDecoder.java, and JdkZlibDecoder.java, but requires explicit configuration (maxAllocation > 0) to be enabled. The fix was authored by Rich DiCroce (scientificgames.com) and shipped in the upstream release that TuxCare onboarded, not applied as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "impact_statement": "The target repository (Netty 4.1.94.Final-tuxcare.2) is NOT AFFECTED by CVE-2020-11612. The vulnerability describes unbounded memory allocation in ZlibDecoders for versions before 4.1.46. The fix mechanism (maxAllocation parameter with prepareDecompressBuffer enforcement) was introduced in upstream commit 1543218d3e (included in Netty 4.1.46.Final, Jan 2020) and is present in the target version. The defense code exists in ZlibDecoder.java, JZlibDecoder.java, and JdkZlibDecoder.java, but requires explicit configuration (maxAllocation > 0) to be enabled. The fix was authored by Rich DiCroce (scientificgames.com) and shipped in the upstream release that TuxCare onboarded, not applied as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T18:29:00.082027+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.94.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 4.1.45, and version 4.1.94.Final is a later release of the same line. Advisories: GitHub GHSA-ff2w-cq2g-wv5f (fixed in 4.1.45), NVD (last affected 4.1.43)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T12:14:42.129766+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 is not present in Netty 4.1.94.Final. The fix (commit 535da17e45) was already shipped in the upstream Netty 4.1.94.Final release before TuxCare onboarded it. The vulnerable pattern (unbounded ClientHello buffer allocation) has been replaced with a configurable length limit that throws TooLongFrameException when exceeded. Default limit is 64KB, preventing the DoS attack described ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34462 is not present in Netty 4.1.94.Final. The fix (commit 535da17e45) was already shipped in the upstream Netty 4.1.94.Final release before TuxCare onboarded it. The vulnerable pattern (unbounded ClientHello buffer allocation) has been replaced with a configurable length limit that throws TooLongFrameException when exceeded. Default limit is 64KB, preventing the DoS attack described ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.94.Final-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 is fixed in version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-45416"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.94.Final-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.94.Final-tuxcare.2 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    }
  ]
}