{
  "@id": "urn:uuid:055850c6-fd18-4e12-ab9d-314a73ee2447",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "action_statement": "Vulnerability CVE-2014-3488 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "action_statement": "Vulnerability CVE-2016-4970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:12:47.728703+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T03:17:51.035769+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      },
      "action_statement": "Vulnerability CVE-2021-37137 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "action_statement": "Vulnerability CVE-2023-34462 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.135.Final-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      },
      "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "action_statement": "Vulnerability CVE-2025-25193 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler. already_fixed \u2014 CVE-2026-44249 has already been fixed in the target repository. The target code at version 4.1.135.Final contains both fixes from the vendor patch: (1) correct use of subnetMask in IPv6 address comparison at line 152, and (2) unsigned BigInteger interpretation at line 248. The fix was applied via the upstream commit 53c089fca9 and backported to earlier versions by TuxCare commit 86f341aa26.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "impact_statement": "already_fixed \u2014 CVE-2026-44249 has already been fixed in the target repository. The target code at version 4.1.135.Final contains both fixes from the vendor patch: (1) correct use of subnetMask in IPv6 address comparison at line 152, and (2) unsigned BigInteger interpretation at line 248. The fix was applied via the upstream commit 53c089fca9 and backported to earlier versions by TuxCare commit 86f341aa26."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler. already_fixed \u2014 The target repository netty version 4.1.135.Final already contains the complete fix for CVE-2026-45416. The fix commit 829c885a45fd9f5ba43fe6caf296214b697366fa is present in the repository history and implements proper default limits (64KB max ClientHello length, 10-second timeout) to prevent unbounded memory allocation from malicious TLS ClientHello messages.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "impact_statement": "already_fixed \u2014 The target repository netty version 4.1.135.Final already contains the complete fix for CVE-2026-45416. The fix commit 829c885a45fd9f5ba43fe6caf296214b697366fa is present in the repository history and implements proper default limits (64KB max ClientHello length, 10-second timeout) to prevent unbounded memory allocation from malicious TLS ClientHello messages."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:15:27.793370+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.135.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-v74w-7mr3-4qg3"
      }
    }
  ]
}