{
  "@id": "urn:uuid:79e267de-910f-41cf-9a94-cdfdb41324b7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "action_statement": "Vulnerability CVE-2014-3488 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:54:14.665991+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "action_statement": "Vulnerability CVE-2016-4970 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:55:41.957093+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:55:41.957093+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler. not_affected \u2014 Version 4.1.42.Final is not affected by CVE-2023-34462. The vulnerable code (fragmented ClientHello handling with unvalidated handshakeLength-based buffer allocation) was introduced in commit 29c471ec52 on 2019-11-29, approximately two months AFTER the 4.1.42.Final release (2019-09-25). The target version only supports ClientHello messages within a single TLS record and parses them directly fro...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34462"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.42.Final is not affected by CVE-2023-34462. The vulnerable code (fragmented ClientHello handling with unvalidated handshakeLength-based buffer allocation) was introduced in commit 29c471ec52 on 2019-11-29, approximately two months AFTER the 4.1.42.Final release (2019-09-25). The target version only supports ClientHello messages within a single TLS record and parses them directly fro..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T11:00:05.020596+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.42.Final-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      },
      "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:55:41.957093+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "action_statement": "Vulnerability CVE-2025-25193 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-17T09:08:00.177306+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-17T09:08:00.177306+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:55:41.957093+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler. Target version 4.1.42.Final (released Sept 2019) is NOT AFFECTED by CVE-2026-45416. The vulnerability requires SslClientHelloHandler.decode() which performs eager allocation based on the 24-bit handshake length field when ClientHello spans multiple TLS records. This class was introduced in February 2020 (commit 8304069a30, PR #9827), approximately 4.5 months AFTER 4.1.42.Final was released. Version 4.1.42.Final uses a completely different architecture where AbstractSniHandler extends ByteToMessageDecoder directly and processes ClientHello in-place from the cumulative input buffer, reading only the 16-bit TLS record length (max ~64KB per record) without any eager allocation based on the 24-bit handshake length. The specific attack chain described in the CVE (reading handshakeLength via getUnsignedMedium, then ctx.alloc().buffer(handshakeLength)) does not exist in this version. Rule 5 Type A2 applies: INPUT is received, but no path from input-receiving code reaches the GOAL (uncontrolled memory allocation based on attacker-supplied handshake length).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "impact_statement": "Target version 4.1.42.Final (released Sept 2019) is NOT AFFECTED by CVE-2026-45416. The vulnerability requires SslClientHelloHandler.decode() which performs eager allocation based on the 24-bit handshake length field when ClientHello spans multiple TLS records. This class was introduced in February 2020 (commit 8304069a30, PR #9827), approximately 4.5 months AFTER 4.1.42.Final was released. Version 4.1.42.Final uses a completely different architecture where AbstractSniHandler extends ByteToMessageDecoder directly and processes ClientHello in-place from the cumulative input buffer, reading only the 16-bit TLS record length (max ~64KB per record) without any eager allocation based on the 24-bit handshake length. The specific attack chain described in the CVE (reading handshakeLength via getUnsignedMedium, then ctx.alloc().buffer(handshakeLength)) does not exist in this version. Rule 5 Type A2 applies: INPUT is received, but no path from input-receiving code reaches the GOAL (uncontrolled memory allocation based on attacker-supplied handshake length)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-17T09:08:00.177306+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.42.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T13:52:29.952159+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.42.Final-tuxcare.1 of io.netty:netty-handler. Netty 4.1.42.Final is not affected by CVE-2026-75596. The vulnerable component io.netty.handler.ssl.SslClientHelloHandler does not exist in this version\u2014it was introduced 4 months after the 4.1.42.Final release (Sept 2019) in commit 8304069a30 (Feb 2020). The CVE describes quadratic CPU complexity from repeated buffer clear+re-copy operations when aggregating fragmented TLS ClientHello messages. This specific vulnerability pattern (handshakeBuffer.clear() followed by unconditional writeBytes re-copying all accumulated data) is unique to SslClientHelloHandler and does not exist in the alternative SNI implementation (AbstractSniHandler) present in 4.1.42.Final. AbstractSniHandler uses ByteToMessageDecoder's linear cumulation and parses ClientHello in-place without buffer re-copying, avoiding the quadratic complexity entirely.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "impact_statement": "Netty 4.1.42.Final is not affected by CVE-2026-75596. The vulnerable component io.netty.handler.ssl.SslClientHelloHandler does not exist in this version\u2014it was introduced 4 months after the 4.1.42.Final release (Sept 2019) in commit 8304069a30 (Feb 2020). The CVE describes quadratic CPU complexity from repeated buffer clear+re-copy operations when aggregating fragmented TLS ClientHello messages. This specific vulnerability pattern (handshakeBuffer.clear() followed by unconditional writeBytes re-copying all accumulated data) is unique to SslClientHelloHandler and does not exist in the alternative SNI implementation (AbstractSniHandler) present in 4.1.42.Final. AbstractSniHandler uses ByteToMessageDecoder's linear cumulation and parses ClientHello in-place without buffer re-copying, avoiding the quadratic complexity entirely."
    }
  ]
}