{
  "@id": "urn:uuid:0d9688f9-43bd-4925-8097-de7a4a3e7f57",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "action_statement": "Vulnerability CVE-2014-3488 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "action_statement": "Vulnerability CVE-2016-4970 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      },
      "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:59.275101+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 Version 4.1.23.Final does not contain the vulnerable code. CVE-2023-34462 affects the fragmented ClientHello handshake handling mechanism that allocates buffers up to 16MB based on the handshakeLength field. This vulnerable code was introduced in commit 29c471ec52 (November 29, 2019) and fixed in commit 535da17e45 (June 20, 2023). Target version 4.1.23.Final was released April 4, 2018\u20141 year an...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.23.Final does not contain the vulnerable code. CVE-2023-34462 affects the fragmented ClientHello handshake handling mechanism that allocates buffers up to 16MB based on the handshakeLength field. This vulnerable code was introduced in commit 29c471ec52 (November 29, 2019) and fixed in commit 535da17e45 (June 20, 2023). Target version 4.1.23.Final was released April 4, 2018\u20141 year an..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.23.Final-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      },
      "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "action_statement": "Vulnerability CVE-2025-25193 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      },
      "action_statement": "Vulnerability CVE-2026-44249 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler. Target version 4.1.23.Final (April 2018) does not contain the vulnerable code. CVE-2026-45416 affects SslClientHelloHandler, which was introduced in Netty 4.1.46+ (February 2020), nearly 2 years after this release. The target uses AbstractSniHandler with a completely different architecture: it extends ByteToMessageDecoder (not SslClientHelloHandler), processes ClientHello in-place without buffer allocation, and handles only single TLS records (max 64KB each). The vulnerable pattern\u2014eagerly allocating ctx.alloc().buffer(handshakeLength) for multi-record ClientHello messages up to 16MB\u2014does not exist in this version. Type A2 analysis: Input (ClientHello) IS received, but the chain to Goal (unbounded allocations) is absent because the allocation step does not exist.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "impact_statement": "Target version 4.1.23.Final (April 2018) does not contain the vulnerable code. CVE-2026-45416 affects SslClientHelloHandler, which was introduced in Netty 4.1.46+ (February 2020), nearly 2 years after this release. The target uses AbstractSniHandler with a completely different architecture: it extends ByteToMessageDecoder (not SslClientHelloHandler), processes ClientHello in-place without buffer allocation, and handles only single TLS records (max 64KB each). The vulnerable pattern\u2014eagerly allocating ctx.alloc().buffer(handshakeLength) for multi-record ClientHello messages up to 16MB\u2014does not exist in this version. Type A2 analysis: Input (ClientHello) IS received, but the chain to Goal (unbounded allocations) is absent because the allocation step does not exist."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.23.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:19:40.187123+00:00",
      "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "GHSA-mfg7-5gfp-c4w3"
      },
      "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.23.Final-tuxcare.1 of io.netty:netty-handler."
    }
  ]
}