{ "@id": "urn:uuid:99d4e274-9d0f-4e31-ab4c-d01b90e27a25", "role": "Document Creator", "author": "https://tuxcare.com", "version": 8, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T15:30:49.741847+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2014-3488 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2014-3488" }, "action_statement": "Vulnerability CVE-2014-3488 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability CVE-2016-4970 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2016-4970" }, "action_statement": "Vulnerability CVE-2016-4970 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2021-37136" }, "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:01:00.133959+00:00", "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2021-37137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml. not_affected \u2014 Netty version 4.1.29.Final is NOT AFFECTED by CVE-2023-34462. The vulnerability exists in a refactored architecture introduced between versions 4.1.29.Final (Sept 2018) and 4.1.50.Final (June 2020). The target version uses an older architecture where ClientHello parsing is performed in-place without the multi-record accumulation feature that enables the 16MB buffer allocation attack. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Netty version 4.1.29.Final is NOT AFFECTED by CVE-2023-34462. The vulnerability exists in a refactored architecture introduced between versions 4.1.29.Final (Sept 2018) and 4.1.50.Final (June 2020). The target version uses an older architecture where ClientHello parsing is performed in-place without the multi-record accumulation feature that enables the 16MB buffer allocation attack. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2023-44487 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2023-44487" }, "action_statement": "Vulnerability CVE-2023-44487 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-codec-xml 4.1.29.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml. not_affected \u2014 Version 4.1.29.Final does not have the BoundedInputStream class that CVE-2025-25193 patches. This CVE specifically addresses a bug in BoundedInputStream (introduced to fix CVE-2024-47535) where null bytes were not counted toward the input limit. Since BoundedInputStream does not exist in 4.1.29.Final, the specific bug described in CVE-2025-25193 cannot be present. TuxCare backports of this CVE ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-25193" }, "impact_statement": "not_affected \u2014 Version 4.1.29.Final does not have the BoundedInputStream class that CVE-2025-25193 patches. This CVE specifically addresses a bug in BoundedInputStream (introduced to fix CVE-2024-47535) where null bytes were not counted toward the input limit. Since BoundedInputStream does not exist in 4.1.29.Final, the specific bug described in CVE-2025-25193 cannot be present. TuxCare backports of this CVE ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42577 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-42577" }, "action_statement": "Vulnerability CVE-2026-42577 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml. CVE-2026-44249 describes a vulnerability in the IpSubnetFilterRule.compareTo(InetSocketAddress) method that incorrectly uses networkAddress instead of subnetMask for bitwise AND operations. Version 4.1.29.Final does NOT have this compareTo method (different architecture - the class only implements IpFilterRule, not Comparable). The actual filtering in this version is performed by the matches() method (line 156) which CORRECTLY uses subnetMask. While an unsigned BigInteger conversion issue exists at line 170 (not passing signum=1), this is a separate issue from the specific CVE-described bug. The CVE's attack chain (compareTo \u2192 wrong mask \u2192 bypass) does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44249" }, "impact_statement": "CVE-2026-44249 describes a vulnerability in the IpSubnetFilterRule.compareTo(InetSocketAddress) method that incorrectly uses networkAddress instead of subnetMask for bitwise AND operations. Version 4.1.29.Final does NOT have this compareTo method (different architecture - the class only implements IpFilterRule, not Comparable). The actual filtering in this version is performed by the matches() method (line 156) which CORRECTLY uses subnetMask. While an unsigned BigInteger conversion issue exists at line 170 (not passing signum=1), this is a separate issue from the specific CVE-described bug. The CVE's attack chain (compareTo \u2192 wrong mask \u2192 bypass) does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml. Version 4.1.29.Final does not contain the vulnerable code pattern. The vulnerability requires SslClientHelloHandler, which was introduced after this version (git commit 8304069a30). The existing AbstractSniHandler only processes single-record ClientHello messages and never allocates buffers based on the 24-bit handshake length field. Multi-record ClientHello handling functionality is entirely absent from this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Version 4.1.29.Final does not contain the vulnerable code pattern. The vulnerability requires SslClientHelloHandler, which was introduced after this version (git commit 8304069a30). The existing AbstractSniHandler only processes single-record ClientHello messages and never allocates buffers based on the 24-bit handshake length field. Multi-record ClientHello handling functionality is entirely absent from this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-56817 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-56817" }, "action_statement": "Vulnerability CVE-2026-56817 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-59901" }, "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-73507 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-73507" }, "action_statement": "Vulnerability CVE-2026-73507 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-codec-xml@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-codec-xml. CVE-2026-75596 affects SslClientHelloHandler, a component introduced in Netty AFTER version 4.1.29.Final. The target uses AbstractSniHandler which does NOT aggregate ClientHello fragments across multiple TLS records and cannot exhibit the quadratic CPU vulnerability. The vulnerable code path with handshakeBuffer.clear() + writeBytes() re-copy pattern does not exist in this version. TuxCare backported the fix to versions 4.1.119.Final+ which have SslClientHelloHandler, but 4.1.29.Final never had the vulnerable component.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "CVE-2026-75596 affects SslClientHelloHandler, a component introduced in Netty AFTER version 4.1.29.Final. The target uses AbstractSniHandler which does NOT aggregate ClientHello fragments across multiple TLS records and cannot exhibit the quadratic CPU vulnerability. The vulnerable code path with handshakeBuffer.clear() + writeBytes() re-copy pattern does not exist in this version. TuxCare backported the fix to versions 4.1.119.Final+ which have SslClientHelloHandler, but 4.1.29.Final never had the vulnerable component." } ] }