{ "@id": "urn:uuid:270ddfb5-9b74-43c4-9382-695897606f0b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 19, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-31T11:38:00.083588+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2014-3488 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2014-3488" }, "action_statement": "Vulnerability CVE-2014-3488 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2016-4970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2016-4970" }, "action_statement": "Vulnerability CVE-2016-4970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T23:33:09.807961+00:00", "status_notes": "Vulnerability CVE-2019-20444 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2019-20444" }, "action_statement": "Vulnerability CVE-2019-20444 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T00:12:47.728703+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T03:17:51.035769+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T23:33:09.807961+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2021-37136" }, "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2021-37137 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2021-37137" }, "action_statement": "Vulnerability CVE-2021-37137 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T23:33:09.807961+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T23:33:09.807961+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T01:45:14.642108+00:00", "status_notes": "Vulnerability CVE-2022-41915 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2022-41915" }, "action_statement": "Vulnerability CVE-2022-41915 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2023-34462 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2023-34462" }, "action_statement": "Vulnerability CVE-2023-34462 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-testsuite 4.1.135.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:21:49.480044+00:00", "status_notes": "Vulnerability CVE-2024-29025 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2024-29025" }, "action_statement": "Vulnerability CVE-2024-29025 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-31T11:24:00.148485+00:00", "status_notes": "Vulnerability CVE-2024-47535 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite. not_affected \u2014 The target repository (Netty 4.1.135.Final-tuxcare.1) is NOT affected by CVE-2024-47535. The vulnerability involved unbounded reading of system files during initialization that could cause out-of-memory crashes when attackers create large files at predictable paths (e.g., C:\\etc\\os-release on Windows). The fix introduces BoundedInputStream, which enforces read limits (default 8KB, up to 1MB) an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-47535" }, "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.135.Final-tuxcare.1) is NOT affected by CVE-2024-47535. The vulnerability involved unbounded reading of system files during initialization that could cause out-of-memory crashes when attackers create large files at predictable paths (e.g., C:\\etc\\os-release on Windows). The fix introduces BoundedInputStream, which enforces read limits (default 8KB, up to 1MB) an..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-31T11:38:00.083588+00:00", "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite. not_affected \u2014 The target repository (Netty 4.1.135.Final-tuxcare.1) is NOT AFFECTED by CVE-2025-25193. The vulnerability involves BoundedInputStream incorrectly counting bytes read - the original buggy code used `if (b > 0)` which excluded null bytes (0x00) from the limit check, allowing memory exhaustion attacks via files filled with null bytes. The fix changes this to `if (b != -1)` to count all byte value...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-25193" }, "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.135.Final-tuxcare.1) is NOT AFFECTED by CVE-2025-25193. The vulnerability involves BoundedInputStream incorrectly counting bytes read - the original buggy code used `if (b > 0)` which excluded null bytes (0x00) from the limit check, allowing memory exhaustion attacks via files filled with null bytes. The fix changes this to `if (b != -1)` to count all byte value..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2025-58056 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2025-58056" }, "action_statement": "Vulnerability CVE-2025-58056 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-31T11:16:00.221272+00:00", "status_notes": "Vulnerability CVE-2025-58057 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite. not_affected \u2014 The target repository (Netty 4.1.135.Final-tuxcare.1) is not affected by CVE-2025-58057. The vulnerability involves unbounded accumulation of decompressed buffers in memory during decompression, leading to OOM/DoS. The fix (commit 34894ac73b by Norman Maurer, upstream) changes decompressing decoders (BrotliDecoder, ZstdDecoder, JZlibDecoder, JdkZlibDecoder) from accumulating all decompressed bu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-58057" }, "impact_statement": "not_affected \u2014 The target repository (Netty 4.1.135.Final-tuxcare.1) is not affected by CVE-2025-58057. The vulnerability involves unbounded accumulation of decompressed buffers in memory during decompression, leading to OOM/DoS. The fix (commit 34894ac73b by Norman Maurer, upstream) changes decompressing decoders (BrotliDecoder, ZstdDecoder, JZlibDecoder, JdkZlibDecoder) from accumulating all decompressed bu..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:21:49.480044+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41417 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite. already_fixed \u2014 The target repository version 4.1.135.Final already contains the complete fix for CVE-2026-41417. The vulnerability allowed CRLF injection through the setUri() method, bypassing constructor validation. The fix was applied via commit 6eea1bc7ef (May 4, 2026), which added validation to both setUri() and setMethod() methods to reject URI strings containing CRLF or whitespace characters. This valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41417" }, "impact_statement": "already_fixed \u2014 The target repository version 4.1.135.Final already contains the complete fix for CVE-2026-41417. The vulnerability allowed CRLF injection through the setUri() method, bypassing constructor validation. The fix was applied via commit 6eea1bc7ef (May 4, 2026), which added validation to both setUri() and setMethod() methods to reject URI strings containing CRLF or whitespace characters. This valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the exact fix for CVE-2026-42580. Vendor patch commit 756840b17c has been applied, implementing integer overflow protection in the getChunkSize method.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the exact fix for CVE-2026-42580. Vendor patch commit 756840b17c has been applied, implementing integer overflow protection in the getChunkSize method." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42581 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the complete fix for CVE-2026-42581. The fix was merged from upstream via commit d2475645d8 (2026-05-04), which is an ancestor of the current HEAD (445f793ae3). The vulnerability is blocked by HttpObjectDecoder rejecting HTTP/1.0 requests with Transfer-Encoding headers (throws TransferEncodingNotAllowedException) and rejecting HTTP/1....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42581" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains the complete fix for CVE-2026-42581. The fix was merged from upstream via commit d2475645d8 (2026-05-04), which is an ancestor of the current HEAD (445f793ae3). The vulnerability is blocked by HttpObjectDecoder rejecting HTTP/1.0 requests with Transfer-Encoding headers (throws TransferEncodingNotAllowedException) and rejecting HTTP/1...." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42584 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite. already_fixed \u2014 CVE-2026-42584 is NOT present in the target. The target repository at version 4.1.135.Final already contains the upstream fix commit 6f69dc91a22ad4b56b8a9361a1906b17d427d99a, which implements the defense against HTTP response body misattribution in pipelined requests with 1xx informational responses. The fix was included in the upstream 4.1.135.Final release and onboarded to this TuxCare reposi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42584" }, "impact_statement": "already_fixed \u2014 CVE-2026-42584 is NOT present in the target. The target repository at version 4.1.135.Final already contains the upstream fix commit 6f69dc91a22ad4b56b8a9361a1906b17d427d99a, which implements the defense against HTTP response body misattribution in pipelined requests with 1xx informational responses. The fix was included in the upstream 4.1.135.Final release and onboarded to this TuxCare reposi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42585 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite. already_fixed \u2014 The target repository Netty 4.1.135.Final already contains the fix for CVE-2026-42585. Commit 485f11d322 (dated May 4, 2026) adds validation to ensure 'chunked' is the final encoding in the Transfer-Encoding header, preventing HTTP request smuggling attacks via malformed headers like 'Transfer-Encoding: chunked, identity'.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42585" }, "impact_statement": "already_fixed \u2014 The target repository Netty 4.1.135.Final already contains the fix for CVE-2026-42585. Commit 485f11d322 (dated May 4, 2026) adds validation to ensure 'chunked' is the final encoding in the Transfer-Encoding header, preventing HTTP request smuggling attacks via malformed headers like 'Transfer-Encoding: chunked, identity'." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains all fixes from the three upstream security patches (fe702a97, 21b8493b, bf78040e) that address CVE-2026-42587. BrotliDecoder and ZstdDecoder both receive maxAllocation parameters, and BrotliDecoder enforces a 64 KiB per-buffer limit to prevent unbounded decompression.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains all fixes from the three upstream security patches (fe702a97, 21b8493b, bf78040e) that address CVE-2026-42587. BrotliDecoder and ZstdDecoder both receive maxAllocation parameters, and BrotliDecoder enforces a 64 KiB per-buffer limit to prevent unbounded decompression." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite. already_fixed \u2014 CVE-2026-44249 has already been fixed in the target repository. The target code at version 4.1.135.Final contains both fixes from the vendor patch: (1) correct use of subnetMask in IPv6 address comparison at line 152, and (2) unsigned BigInteger interpretation at line 248. The fix was applied via the upstream commit 53c089fca9 and backported to earlier versions by TuxCare commit 86f341aa26.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44249" }, "impact_statement": "already_fixed \u2014 CVE-2026-44249 has already been fixed in the target repository. The target code at version 4.1.135.Final contains both fixes from the vendor patch: (1) correct use of subnetMask in IPv6 address comparison at line 152, and (2) unsigned BigInteger interpretation at line 248. The fix was applied via the upstream commit 53c089fca9 and backported to earlier versions by TuxCare commit 86f341aa26." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite. already_fixed \u2014 The target repository netty version 4.1.135.Final already contains the complete fix for CVE-2026-45416. The fix commit 829c885a45fd9f5ba43fe6caf296214b697366fa is present in the repository history and implements proper default limits (64KB max ClientHello length, 10-second timeout) to prevent unbounded memory allocation from malicious TLS ClientHello messages.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "already_fixed \u2014 The target repository netty version 4.1.135.Final already contains the complete fix for CVE-2026-45416. The fix commit 829c885a45fd9f5ba43fe6caf296214b697366fa is present in the repository history and implements proper default limits (64KB max ClientHello length, 10-second timeout) to prevent unbounded memory allocation from malicious TLS ClientHello messages." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-46340 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite. already_fixed \u2014 CVE-2026-46340 is NOT present in the target. The target version 4.1.135.Final already contains the complete upstream fix from commit cef5395186. The vulnerable nested CompositeByteBuf wrapping pattern has been replaced with flat ArrayList collection, and limits on concurrent incomplete messages (128) and fragments per message (128) are enforced.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-46340" }, "impact_statement": "already_fixed \u2014 CVE-2026-46340 is NOT present in the target. The target version 4.1.135.Final already contains the complete upstream fix from commit cef5395186. The vulnerable nested CompositeByteBuf wrapping pattern has been replaced with flat ArrayList collection, and limits on concurrent incomplete messages (128) and fragments per message (128) are enforced." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50020 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite. already_fixed \u2014 The target repository at version 4.1.135.Final already contains the complete upstream fix for CVE-2026-50020. The fix includes the new SKIP_INITIAL_LINE_CHARS state, the skipLineChars method with strict CRLF-only validation, updated documentation, and the regression test. The version 4.1.135.Final is explicitly listed as the fixed version in the CVE description.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-50020" }, "impact_statement": "already_fixed \u2014 The target repository at version 4.1.135.Final already contains the complete upstream fix for CVE-2026-50020. The fix includes the new SKIP_INITIAL_LINE_CHARS state, the skipLineChars method with strict CRLF-only validation, updated documentation, and the regression test. The version 4.1.135.Final is explicitly listed as the fixed version in the CVE description." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55831 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-55831" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55833 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-55833" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56745 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-56745" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-56746 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-56746" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59898 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-59898" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59899 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-59899" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59901 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-59901" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59902 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-59902" }, "action_statement": "Vulnerability CVE-2026-59902 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59921 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-59921" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-75596" }, "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" } } ] }