{ "@id": "urn:uuid:57ef0e89-802b-409f-a246-57fda842462c", "role": "Document Creator", "author": "https://tuxcare.com", "version": 16, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T15:30:49.741847+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2014-3488 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2014-3488" }, "action_statement": "Vulnerability CVE-2014-3488 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2016-4970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2016-4970" }, "action_statement": "Vulnerability CVE-2016-4970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T23:33:09.807961+00:00", "status_notes": "Vulnerability CVE-2019-20444 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2019-20444" }, "action_statement": "Vulnerability CVE-2019-20444 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T00:12:47.728703+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T03:17:51.035769+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T23:33:09.807961+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2021-37136" }, "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2021-37137 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2021-37137" }, "action_statement": "Vulnerability CVE-2021-37137 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T23:33:09.807961+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T23:33:09.807961+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T01:45:14.642108+00:00", "status_notes": "Vulnerability CVE-2022-41915 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2022-41915" }, "action_statement": "Vulnerability CVE-2022-41915 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2023-34462 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2023-34462" }, "action_statement": "Vulnerability CVE-2023-34462 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler-ssl-ocsp 4.1.135.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:21:49.480044+00:00", "status_notes": "Vulnerability CVE-2024-29025 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2024-29025" }, "action_statement": "Vulnerability CVE-2024-29025 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2025-25193 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2025-25193" }, "action_statement": "Vulnerability CVE-2025-25193 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2025-58056" }, "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:21:49.480044+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41417 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp. already_fixed \u2014 The target repository version 4.1.135.Final already contains the complete fix for CVE-2026-41417. The vulnerability allowed CRLF injection through the setUri() method, bypassing constructor validation. The fix was applied via commit 6eea1bc7ef (May 4, 2026), which added validation to both setUri() and setMethod() methods to reject URI strings containing CRLF or whitespace characters. This valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41417" }, "impact_statement": "already_fixed \u2014 The target repository version 4.1.135.Final already contains the complete fix for CVE-2026-41417. The vulnerability allowed CRLF injection through the setUri() method, bypassing constructor validation. The fix was applied via commit 6eea1bc7ef (May 4, 2026), which added validation to both setUri() and setMethod() methods to reject URI strings containing CRLF or whitespace characters. This valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42579 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp. already_fixed \u2014 Target repository version 4.1.135.Final already contains the complete CVE-2026-42579 fix. All RFC 1035 validation checks (null byte rejection, label length <= 63, total length <= 255, empty middle label rejection) are present in both encodeDomainName() and decodeDomainName() methods. The fix was inherited when TuxCare onboarded upstream Netty 4.1.135.Final, which was released after the upstream...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42579" }, "impact_statement": "already_fixed \u2014 Target repository version 4.1.135.Final already contains the complete CVE-2026-42579 fix. All RFC 1035 validation checks (null byte rejection, label length <= 63, total length <= 255, empty middle label rejection) are present in both encodeDomainName() and decodeDomainName() methods. The fix was inherited when TuxCare onboarded upstream Netty 4.1.135.Final, which was released after the upstream..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the exact fix for CVE-2026-42580. Vendor patch commit 756840b17c has been applied, implementing integer overflow protection in the getChunkSize method.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the exact fix for CVE-2026-42580. Vendor patch commit 756840b17c has been applied, implementing integer overflow protection in the getChunkSize method." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42581 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the complete fix for CVE-2026-42581. The fix was merged from upstream via commit d2475645d8 (2026-05-04), which is an ancestor of the current HEAD (445f793ae3). The vulnerability is blocked by HttpObjectDecoder rejecting HTTP/1.0 requests with Transfer-Encoding headers (throws TransferEncodingNotAllowedException) and rejecting HTTP/1....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42581" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the complete fix for CVE-2026-42581. The fix was merged from upstream via commit d2475645d8 (2026-05-04), which is an ancestor of the current HEAD (445f793ae3). The vulnerability is blocked by HttpObjectDecoder rejecting HTTP/1.0 requests with Transfer-Encoding headers (throws TransferEncodingNotAllowedException) and rejecting HTTP/1...." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42584 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp. already_fixed \u2014 CVE-2026-42584 is NOT present in the target. The target repository at version 4.1.135.Final already contains the upstream fix commit 6f69dc91a22ad4b56b8a9361a1906b17d427d99a, which implements the defense against HTTP response body misattribution in pipelined requests with 1xx informational responses. The fix was included in the upstream 4.1.135.Final release and onboarded to this TuxCare reposi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42584" }, "impact_statement": "already_fixed \u2014 CVE-2026-42584 is NOT present in the target. The target repository at version 4.1.135.Final already contains the upstream fix commit 6f69dc91a22ad4b56b8a9361a1906b17d427d99a, which implements the defense against HTTP response body misattribution in pipelined requests with 1xx informational responses. The fix was included in the upstream 4.1.135.Final release and onboarded to this TuxCare reposi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42585 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp. already_fixed \u2014 The target repository Netty 4.1.135.Final already contains the fix for CVE-2026-42585. Commit 485f11d322 (dated May 4, 2026) adds validation to ensure 'chunked' is the final encoding in the Transfer-Encoding header, preventing HTTP request smuggling attacks via malformed headers like 'Transfer-Encoding: chunked, identity'.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42585" }, "impact_statement": "already_fixed \u2014 The target repository Netty 4.1.135.Final already contains the fix for CVE-2026-42585. Commit 485f11d322 (dated May 4, 2026) adds validation to ensure 'chunked' is the final encoding in the Transfer-Encoding header, preventing HTTP request smuggling attacks via malformed headers like 'Transfer-Encoding: chunked, identity'." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains all fixes from the three upstream security patches (fe702a97, 21b8493b, bf78040e) that address CVE-2026-42587. BrotliDecoder and ZstdDecoder both receive maxAllocation parameters, and BrotliDecoder enforces a 64 KiB per-buffer limit to prevent unbounded decompression.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains all fixes from the three upstream security patches (fe702a97, 21b8493b, bf78040e) that address CVE-2026-42587. BrotliDecoder and ZstdDecoder both receive maxAllocation parameters, and BrotliDecoder enforces a 64 KiB per-buffer limit to prevent unbounded decompression." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp. already_fixed \u2014 CVE-2026-44249 has already been fixed in the target repository. The target code at version 4.1.135.Final contains both fixes from the vendor patch: (1) correct use of subnetMask in IPv6 address comparison at line 152, and (2) unsigned BigInteger interpretation at line 248. The fix was applied via the upstream commit 53c089fca9 and backported to earlier versions by TuxCare commit 86f341aa26.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44249" }, "impact_statement": "already_fixed \u2014 CVE-2026-44249 has already been fixed in the target repository. The target code at version 4.1.135.Final contains both fixes from the vendor patch: (1) correct use of subnetMask in IPv6 address comparison at line 152, and (2) unsigned BigInteger interpretation at line 248. The fix was applied via the upstream commit 53c089fca9 and backported to earlier versions by TuxCare commit 86f341aa26." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp. already_fixed \u2014 The target repository netty version 4.1.135.Final already contains the complete fix for CVE-2026-45416. The fix commit 829c885a45fd9f5ba43fe6caf296214b697366fa is present in the repository history and implements proper default limits (64KB max ClientHello length, 10-second timeout) to prevent unbounded memory allocation from malicious TLS ClientHello messages.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "already_fixed \u2014 The target repository netty version 4.1.135.Final already contains the complete fix for CVE-2026-45416. The fix commit 829c885a45fd9f5ba43fe6caf296214b697366fa is present in the repository history and implements proper default limits (64KB max ClientHello length, 10-second timeout) to prevent unbounded memory allocation from malicious TLS ClientHello messages." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45673 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp. already_fixed \u2014 The target repository (Netty 4.1.135.Final at SHA 445f793ae3) already contains the vendor security patch for CVE-2026-45673. Commit 06eb73d74c3075b35a21d882475c06ac41e8e57f, applied on 2026-06-01, replaced predictable ThreadLocalRandom with cryptographically secure SecureRandom for DNS transaction ID generation in DnsQueryIdSpace.java. This fix is an ancestor of the current HEAD and has not bee...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45673" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final at SHA 445f793ae3) already contains the vendor security patch for CVE-2026-45673. Commit 06eb73d74c3075b35a21d882475c06ac41e8e57f, applied on 2026-06-01, replaced predictable ThreadLocalRandom with cryptographically secure SecureRandom for DNS transaction ID generation in DnsQueryIdSpace.java. This fix is an ancestor of the current HEAD and has not bee..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45674 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains both bailiwick validation fixes for CVE-2026-45674. The CNAME bailiwick check was added in commit 5749d7822f and the NS bailiwick check in commit 6f19adf368, both present in the current HEAD. These fixes prevent DNS cache poisoning by validating that DNS resource records (CNAME and NS) originate from authoritative sources within the q...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45674" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains both bailiwick validation fixes for CVE-2026-45674. The CNAME bailiwick check was added in commit 5749d7822f and the NS bailiwick check in commit 6f19adf368, both present in the current HEAD. These fixes prevent DNS cache poisoning by validating that DNS resource records (CNAME and NS) originate from authoritative sources within the q..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47691 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains both DNS Cache Poisoning fixes. Commits 6f19adf368 (NS record bailiwick validation) and 5749d7822f (CNAME bailiwick validation) were applied on June 2, 2026, as part of TuxCare ELS security backports. The bailiwick checks prevent subdomain authoritative servers from poisoning the cache for parent domains or unrelated zones.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47691" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains both DNS Cache Poisoning fixes. Commits 6f19adf368 (NS record bailiwick validation) and 5749d7822f (CNAME bailiwick validation) were applied on June 2, 2026, as part of TuxCare ELS security backports. The bailiwick checks prevent subdomain authoritative servers from poisoning the cache for parent domains or unrelated zones." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50020 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp. already_fixed \u2014 The target repository at version 4.1.135.Final already contains the complete upstream fix for CVE-2026-50020. The fix includes the new SKIP_INITIAL_LINE_CHARS state, the skipLineChars method with strict CRLF-only validation, updated documentation, and the regression test. The version 4.1.135.Final is explicitly listed as the fixed version in the CVE description.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50020" }, "impact_statement": "already_fixed \u2014 The target repository at version 4.1.135.Final already contains the complete upstream fix for CVE-2026-50020. The fix includes the new SKIP_INITIAL_LINE_CHARS state, the skipLineChars method with strict CRLF-only validation, updated documentation, and the regression test. The version 4.1.135.Final is explicitly listed as the fixed version in the CVE description." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55831 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-55831" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-55833" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56745 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-56745" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56746 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-56746" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56820 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-56820" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56821 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-56821" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56822 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-56822" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59898 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-59898" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59899 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-59899" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59901 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-59901" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59921 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-59921" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-73508 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-73508" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "CVE-2026-75596" }, "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-ssl-ocsp@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler-ssl-ocsp.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" } } ] }