{ "@id": "urn:uuid:e6e93548-1fb4-4275-8b59-96ea900217a6", "role": "Document Creator", "author": "https://tuxcare.com", "version": 7, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T15:30:49.741847+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2014-3488 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2014-3488" }, "action_statement": "Vulnerability CVE-2014-3488 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability CVE-2016-4970 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2016-4970" }, "action_statement": "Vulnerability CVE-2016-4970 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T00:16:38.201074+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2021-37136 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler. Target version 4.0.56.Final is NOT AFFECTED by CVE-2021-37136. The vulnerable Bzip2Decoder component and all related Bzip2 decompression classes do not exist in Netty 4.0.x series. Bzip2 support was first introduced in Netty 4.1.0.Beta1 (commit f9021a6061), which is not part of the 4.0.x lineage. The target version predates the introduction of Bzip2 functionality and therefore cannot process Bzip2 compressed data or be exploited via this vulnerability.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-37136" }, "impact_statement": "Target version 4.0.56.Final is NOT AFFECTED by CVE-2021-37136. The vulnerable Bzip2Decoder component and all related Bzip2 decompression classes do not exist in Netty 4.0.x series. Bzip2 support was first introduced in Netty 4.1.0.Beta1 (commit f9021a6061), which is not part of the 4.0.x lineage. The target version predates the introduction of Bzip2 functionality and therefore cannot process Bzip2 compressed data or be exploited via this vulnerability." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2021-37137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 Netty version 4.0.56.Final is NOT affected by CVE-2023-34462. The vulnerability requires code to read a 3-byte handshake length field from TLS ClientHello messages and allocate/accumulate buffers based on that value (up to 16MB). Version 4.0.56.Final uses a completely different architecture: it lacks the SslClientHelloHandler class mentioned in the CVE, does not read the handshake length field,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Netty version 4.0.56.Final is NOT affected by CVE-2023-34462. The vulnerability requires code to read a 3-byte handshake length field from TLS ClientHello messages and allocate/accumulate buffers based on that value (up to 16MB). Version 4.0.56.Final uses a completely different architecture: it lacks the SslClientHelloHandler class mentioned in the CVE, does not read the handshake length field,..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.0.56.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2025-24970" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2025-25193 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2025-25193" }, "action_statement": "Vulnerability CVE-2025-25193 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2025-58057 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 Version 4.0.56.Final is not affected by CVE-2025-58057. The vulnerability pattern involves accumulating MULTIPLE byte buffers during a single decompression operation. BrotliDecoder (the primary vulnerable component) does not exist in this version. The ZLib decoders present (JdkZlibDecoder, JZlibDecoder) allocate a SINGLE buffer per decode() call and expand it as needed, rather than accumulating...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2025-58057" }, "impact_statement": "not_affected \u2014 Version 4.0.56.Final is not affected by CVE-2025-58057. The vulnerability pattern involves accumulating MULTIPLE byte buffers during a single decompression operation. BrotliDecoder (the primary vulnerable component) does not exist in this version. The ZLib decoders present (JdkZlibDecoder, JZlibDecoder) allocate a SINGLE buffer per decode() call and expand it as needed, rather than accumulating..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2026-42583 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler. Netty version 4.0.56.Final is not affected by CVE-2026-42583. The vulnerable component (Lz4FrameDecoder) does not exist in this version. LZ4 codec support was introduced in Netty 4.1.0.Beta2 and was never added to the 4.0 release line. No LZ4-related code, classes, or dependencies are present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42583" }, "impact_statement": "Netty version 4.0.56.Final is not affected by CVE-2026-42583. The vulnerable component (Lz4FrameDecoder) does not exist in this version. LZ4 codec support was introduced in Netty 4.1.0.Beta2 and was never added to the 4.0 release line. No LZ4-related code, classes, or dependencies are present in this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2026-44249 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-44249" }, "action_statement": "Vulnerability CVE-2026-44249 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler. Version 4.0.56.Final is not affected by CVE-2026-45416. The vulnerable classes SslClientHelloHandler and AbstractSniHandler do not exist in this version - they were introduced in Netty 4.1.x. The 4.0.x SniHandler uses a fundamentally different architecture that parses ClientHello inline from the channel's input buffer without eager allocation based on protocol length fields. The vulnerability pattern (reading 24-bit handshake length and immediately allocating ctx.alloc().buffer(handshakeLength) before data arrives) does not exist in 4.0.56.Final.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Version 4.0.56.Final is not affected by CVE-2026-45416. The vulnerable classes SslClientHelloHandler and AbstractSniHandler do not exist in this version - they were introduced in Netty 4.1.x. The 4.0.x SniHandler uses a fundamentally different architecture that parses ClientHello inline from the channel's input buffer without eager allocation based on protocol length fields. The vulnerability pattern (reading 24-bit handshake length and immediately allocating ctx.alloc().buffer(handshakeLength) before data arrives) does not exist in 4.0.56.Final." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2026-59901 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler. Version 4.0.56.Final does not contain Bzip2 decompression functionality. The Bzip2Decoder and its vulnerable RLE state machine were added to Netty in version 4.1.0.Beta1 (June 2014), which is in the 4.1.x series. Version 4.0.56.Final is from the older 4.0.x maintenance branch and never received Bzip2 support. The compression package contains only Zlib and Snappy codecs, with a TODO comment confirming bzip2 was planned but not implemented.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59901" }, "impact_statement": "Version 4.0.56.Final does not contain Bzip2 decompression functionality. The Bzip2Decoder and its vulnerable RLE state machine were added to Netty in version 4.1.0.Beta1 (June 2014), which is in the 4.1.x series. Version 4.0.56.Final is from the older 4.0.x maintenance branch and never received Bzip2 support. The compression package contains only Zlib and Snappy codecs, with a TODO comment confirming bzip2 was planned but not implemented." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler@4.0.56.Final-tuxcare.1" } } ], "timestamp": "2026-10-26T15:29:41.341271+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.0.56.Final-tuxcare.1 of io.netty:netty-handler. Netty 4.0.56.Final (released 2018-02-05) pre-dates the introduction of the vulnerable fragmented ClientHello aggregation code by almost 2 years. The CVE-2026-75596 vulnerability exists in SslClientHelloHandler's handshakeBuffer.clear() + writeBytes() pattern, which causes quadratic CPU consumption. This class and mechanism were introduced in 2019-2020 for the 4.1.x branch. Version 4.0.56.Final uses a simpler SniHandler architecture that waits for complete TLS records and parses inline without any aggregation buffer, so the vulnerable code is not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "Netty 4.0.56.Final (released 2018-02-05) pre-dates the introduction of the vulnerable fragmented ClientHello aggregation code by almost 2 years. The CVE-2026-75596 vulnerability exists in SslClientHelloHandler's handshakeBuffer.clear() + writeBytes() pattern, which causes quadratic CPU consumption. This class and mechanism were introduced in 2019-2020 for the 4.1.x branch. Version 4.0.56.Final uses a simpler SniHandler architecture that waits for complete TLS records and parses inline without any aggregation buffer, so the vulnerable code is not present in this version." } ] }