{ "@id": "urn:uuid:9adfc44a-4198-4c38-9d78-1f8af38eb4d8", "role": "Document Creator", "author": "https://tuxcare.com", "version": 7, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T16:32:00.109512+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T18:11:48.204695+00:00", "status_notes": "Vulnerability CVE-2014-3488 does not affect version 4.2.2.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2014-3488 affects Netty 3.x before 3.9.2 due to infinite loop when processing SSLv2Hello messages with buffer size requirements exceeding the fixed-size SslBufferPool capacity. The target Netty 4.2.2.Final has an upstream fix from 2015 (commit 9660e2f6a98 by Norman Maurer) that properly handles BUFFER_OVERFLOW by dynamically allocating buffers of the required size. This fix was already pres...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3488" }, "impact_statement": "not_affected \u2014 CVE-2014-3488 affects Netty 3.x before 3.9.2 due to infinite loop when processing SSLv2Hello messages with buffer size requirements exceeding the fixed-size SslBufferPool capacity. The target Netty 4.2.2.Final has an upstream fix from 2015 (commit 9660e2f6a98 by Norman Maurer) that properly handles BUFFER_OVERFLOW by dynamically allocating buffers of the required size. This fix was already pres..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T14:14:47.812204+00:00", "status_notes": "Vulnerability CVE-2016-4970 does not affect version 4.2.2.Final-tuxcare.2 of io.netty:netty-handler. CVE-2016-4970 describes an infinite loop in Netty's OpenSslEngine when SSL_write returns SSL_ERROR_WANT_READ/WANT_WRITE with no data in the BIO buffer. The target (Netty 4.2.2.Final) is NOT affected. The vulnerable pattern (using 'break' to continue looping) is not present in the target. Instead, the target's ReferenceCountedOpenSslEngine.java explicitly returns from the wrap() method when these error conditions occur (lines 1018-1041), giving control back to the event loop and preventing the infinite loop. This defensive code was introduced in upstream commit 7d774584c8 (2016-07-14) by Scott Mitchell, which predates the TuxCare onboarding of version 4.2.2.Final. The fix was already present in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4970" }, "impact_statement": "CVE-2016-4970 describes an infinite loop in Netty's OpenSslEngine when SSL_write returns SSL_ERROR_WANT_READ/WANT_WRITE with no data in the BIO buffer. The target (Netty 4.2.2.Final) is NOT affected. The vulnerable pattern (using 'break' to continue looping) is not present in the target. Instead, the target's ReferenceCountedOpenSslEngine.java explicitly returns from the wrap() method when these error conditions occur (lines 1018-1041), giving control back to the event loop and preventing the infinite loop. This defensive code was introduced in upstream commit 7d774584c8 (2016-07-14) by Scott Mitchell, which predates the TuxCare onboarding of version 4.2.2.Final. The fix was already present in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final), NVD (>= 4.0.20, < 4.0.37; >= 4.1.0, < 4.1.1), Snyk (>= 4.0.0.Alpha1, < 4.0.37.Final; >= 4.1.0.Beta1, < 4.1.1.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2" } } ], "timestamp": "2026-11-06T18:03:00.046051+00:00", "status_notes": "Vulnerability CVE-2019-20445 does not affect version 4.2.2.Final-tuxcare.2 of io.netty:netty-handler. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 4.2.2.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-p2v9-g2qv-p635 (affected up to 4.1.45), NVD (affected up to 4.1.44).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-20445" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 4.2.2.Final is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-p2v9-g2qv-p635 (affected up to 4.1.45), NVD (affected up to 4.1.44)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2020-11612 does not affect version 4.2.2.Final-tuxcare.2 of io.netty:netty-handler. The target repository (Netty 4.2.2.Final-tuxcare.1) is NOT AFFECTED by CVE-2020-11612. The upstream fix for unbounded memory allocation in ZlibDecoders (commit 1543218d3e from January 31, 2020) was already present in the Netty 4.2.2.Final release that TuxCare onboarded. The vulnerable pattern does not exist in the target because the upstream vendor's fix shipped with the release before TuxCare's maintenance began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-11612" }, "impact_statement": "The target repository (Netty 4.2.2.Final-tuxcare.1) is NOT AFFECTED by CVE-2020-11612. The upstream fix for unbounded memory allocation in ZlibDecoders (commit 1543218d3e from January 31, 2020) was already present in the Netty 4.2.2.Final release that TuxCare onboarded. The vulnerable pattern does not exist in the target because the upstream vendor's fix shipped with the release before TuxCare's maintenance began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.0, < 4.1.46), NVD (>= 4.1, < 4.1.46), Snyk (>= 4.1.0.Final, < 4.1.46.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2020-7238 does not affect version 4.2.2.Final-tuxcare.2 of io.netty:netty-handler. CVE-2020-7238 is NOT present in Netty 4.2.2.Final-tuxcare.2. The vulnerability involves HTTP Request Smuggling through mishandling of contradictory message-length specifications (multiple Content-Length headers or Content-Length combined with Transfer-Encoding: chunked). The fix was already present in the upstream Netty 4.2.2.Final release that TuxCare onboarded, authored by Norman Maurer in commit 8494b046ec. The defense code in HttpObjectDecoder and HttpUtil properly rejects these ambiguous header combinations by default, preventing request smuggling attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-7238" }, "impact_statement": "CVE-2020-7238 is NOT present in Netty 4.2.2.Final-tuxcare.2. The vulnerability involves HTTP Request Smuggling through mishandling of contradictory message-length specifications (multiple Content-Length headers or Content-Length combined with Transfer-Encoding: chunked). The fix was already present in the upstream Netty 4.2.2.Final release that TuxCare onboarded, authored by Norman Maurer in commit 8494b046ec. The defense code in HttpObjectDecoder and HttpUtil properly rejects these ambiguous header combinations by default, preventing request smuggling attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.43, < 4.1.45), NVD (= 4.1.43), Snyk (< 4.1.44.Final; < 4.1.44.Final)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T14:14:47.812204+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.2.2.Final-tuxcare.2 of io.netty:netty-handler. not_affected \u2014 CVE-2023-34462 is not present in the target. The upstream fix (commit 535da17e45 by Norman Maurer) was already included in Netty 4.2.2.Final before TuxCare onboarded this version. The fix adds maxClientHelloLength validation with proper error handling via TooLongFrameException, preventing unbounded buffer allocation and parser hangs from malformed ClientHello messages. All three handler classes...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 CVE-2023-34462 is not present in the target. The upstream fix (commit 535da17e45 by Norman Maurer) was already included in Netty 4.2.2.Final before TuxCare onboarded this version. The fix adds maxClientHelloLength validation with proper error handling via TooLongFrameException, preventing unbounded buffer allocation and parser hangs from malformed ClientHello messages. All three handler classes..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T14:14:47.812204+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.2.2.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T14:14:47.812204+00:00", "status_notes": "Vulnerability CVE-2025-24970 does not affect version 4.2.2.Final-tuxcare.2 of io.netty:netty-handler. The target repository io.netty:netty-parent:4.2.2.Final-tuxcare.1 is NOT AFFECTED by CVE-2025-24970. The complete fix for this vulnerability was already present in the upstream Netty 4.2.2.Final release before TuxCare onboarding. The fix was authored by Norman Maurer (norman_maurer@apple.com), an upstream Netty maintainer from Apple, and was included in commit 178b22cbf85 dated 2025-02-10. All three affected components (SslUtils.java, ReferenceCountedOpenSslEngine.java, SslHandler.java) contain the complete vulnerability mitigation. The vulnerable pattern (missing length validation before parsing SSL packet headers, which could cause native crash) has been removed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.91.Final, < 4.1.118.Final), NVD (>= 4.1.91, < 4.1.118), cve.org (>= 4.1.91.Final, <= 4.1.117.Final), Snyk (>= 4.1.91.Final, < 4.1.118.Final; >= 4.2.0.Alpha1, < 4.2.0.RC3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-24970" }, "impact_statement": "The target repository io.netty:netty-parent:4.2.2.Final-tuxcare.1 is NOT AFFECTED by CVE-2025-24970. The complete fix for this vulnerability was already present in the upstream Netty 4.2.2.Final release before TuxCare onboarding. The fix was authored by Norman Maurer (norman_maurer@apple.com), an upstream Netty maintainer from Apple, and was included in commit 178b22cbf85 dated 2025-02-10. All three affected components (SslUtils.java, ReferenceCountedOpenSslEngine.java, SslHandler.java) contain the complete vulnerability mitigation. The vulnerable pattern (missing length validation before parsing SSL packet headers, which could cause native crash) has been removed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.1.91.Final, < 4.1.118.Final), NVD (>= 4.1.91, < 4.1.118), cve.org (>= 4.1.91.Final, <= 4.1.117.Final), Snyk (>= 4.1.91.Final, < 4.1.118.Final; >= 4.2.0.Alpha1, < 4.2.0.RC3)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T14:14:47.812204+00:00", "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.2.2.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-44249" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T14:14:47.812204+00:00", "status_notes": "Vulnerability CVE-2026-45416 affects version 4.2.2.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-45416" }, "action_statement": "Vulnerability CVE-2026-45416 affects version 4.2.2.Final-tuxcare.2 of io.netty:netty-handler." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2" } } ], "timestamp": "2026-11-03T14:14:47.812204+00:00", "status_notes": "Vulnerability CVE-2026-50010 is fixed in version 4.2.2.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-50010" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2" } } ], "timestamp": "2026-11-12T16:31:00.096719+00:00", "status_notes": "Vulnerability CVE-2026-75595 is fixed in version 4.2.2.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75595" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.2.2.Final-tuxcare.2" } } ], "timestamp": "2026-11-12T16:32:00.109512+00:00", "status_notes": "Vulnerability CVE-2026-75596 is fixed in version 4.2.2.Final-tuxcare.2 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75596" } } ] }