{ "@id": "urn:uuid:e51d50c8-f584-4a93-8d4c-b7c8fa71b784", "role": "Document Creator", "author": "https://tuxcare.com", "version": 8, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T15:30:49.741847+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2014-3488 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2014-3488" }, "action_statement": "Vulnerability CVE-2014-3488 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability CVE-2016-4970 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2016-4970" }, "action_statement": "Vulnerability CVE-2016-4970 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2021-37136 is fixed in version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2021-37136" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2021-37137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml. not_affected \u2014 Target version 4.1.21.Final is NOT affected by CVE-2023-34462. The vulnerability exists in SslClientHelloHandler, which was introduced AFTER this version (commit 8304069a30). The target uses AbstractSniHandler which parses ClientHello messages in-place without pre-allocating buffers based on the attacker-controlled handshake length field. The vulnerable code pattern (handshakeBuffer = ctx.alloc...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Target version 4.1.21.Final is NOT affected by CVE-2023-34462. The vulnerability exists in SslClientHelloHandler, which was introduced AFTER this version (commit 8304069a30). The target uses AbstractSniHandler which parses ClientHello messages in-place without pre-allocating buffers based on the attacker-controlled handshake length field. The vulnerable code pattern (handshakeBuffer = ctx.alloc..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-codec-xml 4.1.21.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2025-24970" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2025-25193 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2025-25193" }, "action_statement": "Vulnerability CVE-2025-25193 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml. Target version 4.1.21.Final is NOT AFFECTED by CVE-2026-44249. The CVE describes a vulnerability in the IpSubnetFilterRule.compareTo() method that uses networkAddress instead of subnetMask in a bitwise AND operation. Version 4.1.21.Final (released February 2018) does not have a compareTo() method - it was added 2.5 years later in September 2020. The target uses a matches() method that correctly applies subnetMask (line 156). While the target does have a signed BigInteger bug (line 170 missing unsigned parameter), this bug alone does not cause bypass vulnerabilities in the target's simpler code architecture where subnet masking is correctly implemented.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44249" }, "impact_statement": "Target version 4.1.21.Final is NOT AFFECTED by CVE-2026-44249. The CVE describes a vulnerability in the IpSubnetFilterRule.compareTo() method that uses networkAddress instead of subnetMask in a bitwise AND operation. Version 4.1.21.Final (released February 2018) does not have a compareTo() method - it was added 2.5 years later in September 2020. The target uses a matches() method that correctly applies subnetMask (line 156). While the target does have a signed BigInteger bug (line 170 missing unsigned parameter), this bug alone does not cause bypass vulnerabilities in the target's simpler code architecture where subnet masking is correctly implemented." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml. Netty version 4.1.21.Final is NOT AFFECTED by CVE-2026-45416. The vulnerability exists in SslClientHelloHandler.decode(), which handles multi-record TLS ClientHello messages by reading a 24-bit handshake length field and eagerly allocating ctx.alloc().buffer(handshakeLength). This class does not exist in version 4.1.21.Final. Instead, this version uses AbstractSniHandler (extending ByteToMessageDecoder directly) that parses ClientHello inline from the input buffer without reading the 24-bit handshake length field or performing eager allocation. The vulnerable code path was introduced in a later version when SslClientHelloHandler was added to support fragmented ClientHello messages. Backports of this CVE exist for versions 4.1.63.Final and later (which do have SslClientHelloHandler), but no backport exists for 4.1.21.Final, confirming it does not need the fix. The attack chain (multi-record ClientHello \u2192 read handshake length \u2192 eager allocation) is absent in this version.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Netty version 4.1.21.Final is NOT AFFECTED by CVE-2026-45416. The vulnerability exists in SslClientHelloHandler.decode(), which handles multi-record TLS ClientHello messages by reading a 24-bit handshake length field and eagerly allocating ctx.alloc().buffer(handshakeLength). This class does not exist in version 4.1.21.Final. Instead, this version uses AbstractSniHandler (extending ByteToMessageDecoder directly) that parses ClientHello inline from the input buffer without reading the 24-bit handshake length field or performing eager allocation. The vulnerable code path was introduced in a later version when SslClientHelloHandler was added to support fragmented ClientHello messages. Backports of this CVE exist for versions 4.1.63.Final and later (which do have SslClientHelloHandler), but no backport exists for 4.1.21.Final, confirming it does not need the fix. The attack chain (multi-record ClientHello \u2192 read handshake length \u2192 eager allocation) is absent in this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2026-56817 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-56817" }, "action_statement": "Vulnerability CVE-2026-56817 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-59901" }, "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2026-73507 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-73507" }, "action_statement": "Vulnerability CVE-2026-73507 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml. Target version 4.1.21.Final (released Feb 2018) does not contain the vulnerable SslClientHelloHandler class, which was introduced in Feb 2020 (commit 8304069a30). The target uses AbstractSniHandler, a different implementation that does NOT accumulate ClientHello fragments across multiple TLS records and has no handshakeBuffer clear+recopy pattern. When a fragmented ClientHello arrives, AbstractSniHandler parses only the first TLS record; if incomplete, it falls back to the default SSL context and removes itself from the pipeline. No subsequent decode() calls occur, preventing any O(n\u00b2) re-copying. The ByteToMessageDecoder parent class cumulation is append-only with no clear() operation. The attack chain from fragmented input to quadratic CPU consumption does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "Target version 4.1.21.Final (released Feb 2018) does not contain the vulnerable SslClientHelloHandler class, which was introduced in Feb 2020 (commit 8304069a30). The target uses AbstractSniHandler, a different implementation that does NOT accumulate ClientHello fragments across multiple TLS records and has no handshakeBuffer clear+recopy pattern. When a fragmented ClientHello arrives, AbstractSniHandler parses only the first TLS record; if incomplete, it falls back to the default SSL context and removes itself from the pipeline. No subsequent decode() calls occur, preventing any O(n\u00b2) re-copying. The ByteToMessageDecoder parent class cumulation is append-only with no clear() operation. The attack chain from fragmented input to quadratic CPU consumption does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.21.Final-tuxcare.2" } } ], "timestamp": "2026-10-27T22:03:41.878511+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.21.Final-tuxcare.2 of io.netty:netty-codec-xml." } ] }