{ "@id": "urn:uuid:d4d99861-d930-4c5f-9c0c-76f2b4587bc1", "role": "Document Creator", "author": "https://tuxcare.com", "version": 8, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T15:30:49.741847+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2014-3488 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2014-3488" }, "action_statement": "Vulnerability CVE-2014-3488 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T23:00:15.311032+00:00", "status_notes": "Vulnerability CVE-2016-4970 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2016-4970" }, "action_statement": "Vulnerability CVE-2016-4970 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:01:00.133959+00:00", "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2019-20444" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2021-37136" }, "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:01:00.133959+00:00", "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2021-37137" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2022-41915 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2022-41915" }, "action_statement": "Vulnerability CVE-2022-41915 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite. not_affected \u2014 Netty version 4.1.29.Final is NOT AFFECTED by CVE-2023-34462. The vulnerability exists in a refactored architecture introduced between versions 4.1.29.Final (Sept 2018) and 4.1.50.Final (June 2020). The target version uses an older architecture where ClientHello parsing is performed in-place without the multi-record accumulation feature that enables the 16MB buffer allocation attack. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Netty version 4.1.29.Final is NOT AFFECTED by CVE-2023-34462. The vulnerability exists in a refactored architecture introduced between versions 4.1.29.Final (Sept 2018) and 4.1.50.Final (June 2020). The target version uses an older architecture where ClientHello parsing is performed in-place without the multi-record accumulation feature that enables the 16MB buffer allocation attack. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2023-44487 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2023-44487" }, "action_statement": "Vulnerability CVE-2023-44487 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-testsuite 4.1.29.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:01:00.133959+00:00", "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2024-29025" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite. not_affected \u2014 Version 4.1.29.Final does not have the BoundedInputStream class that CVE-2025-25193 patches. This CVE specifically addresses a bug in BoundedInputStream (introduced to fix CVE-2024-47535) where null bytes were not counted toward the input limit. Since BoundedInputStream does not exist in 4.1.29.Final, the specific bug described in CVE-2025-25193 cannot be present. TuxCare backports of this CVE ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-25193" }, "impact_statement": "not_affected \u2014 Version 4.1.29.Final does not have the BoundedInputStream class that CVE-2025-25193 patches. This CVE specifically addresses a bug in BoundedInputStream (introduced to fix CVE-2024-47535) where null bytes were not counted toward the input limit. Since BoundedInputStream does not exist in 4.1.29.Final, the specific bug described in CVE-2025-25193 cannot be present. TuxCare backports of this CVE ..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:01:00.133959+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-41417" }, "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42577 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-42577" }, "action_statement": "Vulnerability CVE-2026-42577 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite. not_affected \u2014 Target version 4.1.29.Final is not affected by CVE-2026-42580. The target uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow validation. When the PoC chunk size \"100000004\" (0x100000004 = 4,294,967,300) exceeds Integer.MAX_VALUE (2,147,483,647), parseInt throws NumberFormatException. The exception is caught and invalidChunk consumes the entire buffer, preventing ...", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Target version 4.1.29.Final is not affected by CVE-2026-42580. The target uses Integer.parseInt(hex, 16) for chunk size parsing, which has built-in overflow validation. When the PoC chunk size \"100000004\" (0x100000004 = 4,294,967,300) exceeds Integer.MAX_VALUE (2,147,483,647), parseInt throws NumberFormatException. The exception is caught and invalidChunk consumes the entire buffer, preventing ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-42581" }, "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-42584" }, "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite. Netty 4.1.29.Final is not affected by CVE-2026-42587. This version predates the vulnerable feature: HttpContentDecompressor has no maxAllocation parameter and does not support brotli, zstd, or snappy encodings. The CVE describes a bypass of maxAllocation protection for these encodings in later versions that added this decompression bomb protection feature. Since the feature does not exist in 4.1.29.Final, the vulnerability pattern cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "Netty 4.1.29.Final is not affected by CVE-2026-42587. This version predates the vulnerable feature: HttpContentDecompressor has no maxAllocation parameter and does not support brotli, zstd, or snappy encodings. The CVE describes a bypass of maxAllocation protection for these encodings in later versions that added this decompression bomb protection feature. Since the feature does not exist in 4.1.29.Final, the vulnerability pattern cannot manifest." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite. CVE-2026-44249 describes a vulnerability in the IpSubnetFilterRule.compareTo(InetSocketAddress) method that incorrectly uses networkAddress instead of subnetMask for bitwise AND operations. Version 4.1.29.Final does NOT have this compareTo method (different architecture - the class only implements IpFilterRule, not Comparable). The actual filtering in this version is performed by the matches() method (line 156) which CORRECTLY uses subnetMask. While an unsigned BigInteger conversion issue exists at line 170 (not passing signum=1), this is a separate issue from the specific CVE-described bug. The CVE's attack chain (compareTo \u2192 wrong mask \u2192 bypass) does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44249" }, "impact_statement": "CVE-2026-44249 describes a vulnerability in the IpSubnetFilterRule.compareTo(InetSocketAddress) method that incorrectly uses networkAddress instead of subnetMask for bitwise AND operations. Version 4.1.29.Final does NOT have this compareTo method (different architecture - the class only implements IpFilterRule, not Comparable). The actual filtering in this version is performed by the matches() method (line 156) which CORRECTLY uses subnetMask. While an unsigned BigInteger conversion issue exists at line 170 (not passing signum=1), this is a separate issue from the specific CVE-described bug. The CVE's attack chain (compareTo \u2192 wrong mask \u2192 bypass) does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite. Version 4.1.29.Final does not contain the vulnerable code pattern. The vulnerability requires SslClientHelloHandler, which was introduced after this version (git commit 8304069a30). The existing AbstractSniHandler only processes single-record ClientHello messages and never allocates buffers based on the 24-bit handshake length field. Multi-record ClientHello handling functionality is entirely absent from this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Version 4.1.29.Final does not contain the vulnerable code pattern. The vulnerability requires SslClientHelloHandler, which was introduced after this version (git commit 8304069a30). The existing AbstractSniHandler only processes single-record ClientHello messages and never allocates buffers based on the 24-bit handshake length field. Multi-record ClientHello handling functionality is entirely absent from this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T18:43:43.968663+00:00", "status_notes": "Vulnerability CVE-2026-46340 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite, and is fixed in 4.1.29.Final-tuxcare.2.", "vulnerability": { "name": "CVE-2026-46340" }, "action_statement": "Vulnerability CVE-2026-46340 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite, and is fixed in 4.1.29.Final-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-50020" }, "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-59901" }, "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59902 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-59902" }, "action_statement": "Vulnerability CVE-2026-59902 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-testsuite@4.1.29.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T10:00:27.869119+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.29.Final-tuxcare.1 of io.netty:netty-testsuite. CVE-2026-75596 affects SslClientHelloHandler, a component introduced in Netty AFTER version 4.1.29.Final. The target uses AbstractSniHandler which does NOT aggregate ClientHello fragments across multiple TLS records and cannot exhibit the quadratic CPU vulnerability. The vulnerable code path with handshakeBuffer.clear() + writeBytes() re-copy pattern does not exist in this version. TuxCare backported the fix to versions 4.1.119.Final+ which have SslClientHelloHandler, but 4.1.29.Final never had the vulnerable component.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "CVE-2026-75596 affects SslClientHelloHandler, a component introduced in Netty AFTER version 4.1.29.Final. The target uses AbstractSniHandler which does NOT aggregate ClientHello fragments across multiple TLS records and cannot exhibit the quadratic CPU vulnerability. The vulnerable code path with handshakeBuffer.clear() + writeBytes() re-copy pattern does not exist in this version. TuxCare backported the fix to versions 4.1.119.Final+ which have SslClientHelloHandler, but 4.1.29.Final never had the vulnerable component." } ] }