{
  "@id": "urn:uuid:235c9576-1d3c-4de4-84f7-a5684dc48d61",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2014-3488 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2014-3488"
      },
      "action_statement": "Vulnerability CVE-2014-3488 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:00:15.311032+00:00",
      "status_notes": "Vulnerability CVE-2016-4970 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2016-4970"
      },
      "action_statement": "Vulnerability CVE-2016-4970 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2019-20445"
      },
      "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-11612"
      },
      "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2020-7238"
      },
      "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2021-37136 is fixed in version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2021-37136"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2021-37137"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2023-34462 is fixed in version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-34462"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler 4.1.43.Final-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2023-4586"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2024-47535 is fixed in version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2024-47535"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-24970"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler. not_affected \u2014 Version 4.1.43.Final is not affected by CVE-2025-25193. The vulnerability describes a bug in the BoundedInputStream class where null-bytes (0x00) are not counted against the input limit due to incorrect byte-counting logic (using `if (b > 0)` instead of `if (b != -1)`). However, BoundedInputStream does not exist in version 4.1.43.Final at all. BoundedInputStream was introduced in later versions...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-25193"
      },
      "impact_statement": "not_affected \u2014 Version 4.1.43.Final is not affected by CVE-2025-25193. The vulnerability describes a bug in the BoundedInputStream class where null-bytes (0x00) are not counted against the input limit due to incorrect byte-counting logic (using `if (b > 0)` instead of `if (b != -1)`). However, BoundedInputStream does not exist in version 4.1.43.Final at all. BoundedInputStream was introduced in later versions..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2025-58057"
      },
      "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-42583"
      },
      "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2026-44249 is fixed in version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-44249"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler. Version 4.1.43.Final is not affected by CVE-2026-45416. The vulnerability requires SslClientHelloHandler, which was introduced in February 2020 (commit #9827), four months after 4.1.43.Final was released (October 2019). The target's AbstractSniHandler extends ByteToMessageDecoder and processes ClientHello in-place without eager buffer allocation. The architectural change that introduced the vulnerable pattern (AbstractSniHandler extending SslClientHelloHandler with eager buffer allocation based on handshake length) occurred after this version. The vulnerable code pattern is absent in 4.1.43.Final.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-45416"
      },
      "impact_statement": "Version 4.1.43.Final is not affected by CVE-2026-45416. The vulnerability requires SslClientHelloHandler, which was introduced in February 2020 (commit #9827), four months after 4.1.43.Final was released (October 2019). The target's AbstractSniHandler extends ByteToMessageDecoder and processes ClientHello in-place without eager buffer allocation. The architectural change that introduced the vulnerable pattern (AbstractSniHandler extending SslClientHelloHandler with eager buffer allocation based on handshake length) occurred after this version. The vulnerable code pattern is absent in 4.1.43.Final."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-50010"
      },
      "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-59901"
      },
      "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler.",
      "vulnerability": {
        "name": "CVE-2026-75595"
      },
      "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/io.netty/netty-handler@4.1.43.Final-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-26T16:16:34.132788+00:00",
      "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.43.Final-tuxcare.3 of io.netty:netty-handler. Netty 4.1.43.Final is not affected by CVE-2026-75596. The vulnerable code (SslClientHelloHandler with quadratic ClientHello fragment aggregation) was introduced in version 4.1.44+ (February 2020), approximately 3.5 months AFTER the 4.1.43.Final release (October 2019). The target version uses AbstractSniHandler which does not implement multi-record ClientHello aggregation and therefore cannot exhibit the quadratic re-copying behavior described in the CVE.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-75596"
      },
      "impact_statement": "Netty 4.1.43.Final is not affected by CVE-2026-75596. The vulnerable code (SslClientHelloHandler with quadratic ClientHello fragment aggregation) was introduced in version 4.1.44+ (February 2020), approximately 3.5 months AFTER the 4.1.43.Final release (October 2019). The target version uses AbstractSniHandler which does not implement multi-record ClientHello aggregation and therefore cannot exhibit the quadratic re-copying behavior described in the CVE."
    }
  ]
}