{ "@id": "urn:uuid:2685d18d-4a37-4c24-8713-90c190b0112d", "role": "Document Creator", "author": "https://tuxcare.com", "version": 16, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T15:30:49.741847+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2014-3488 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2014-3488" }, "action_statement": "Vulnerability CVE-2014-3488 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2016-4970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2016-4970" }, "action_statement": "Vulnerability CVE-2016-4970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T00:12:47.728703+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T03:17:51.035769+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2021-37136" }, "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:54:14.665991+00:00", "status_notes": "Vulnerability CVE-2021-37137 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2021-37137" }, "action_statement": "Vulnerability CVE-2021-37137 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2023-34462 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2023-34462" }, "action_statement": "Vulnerability CVE-2023-34462 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-transport-blockhound-tests 4.1.135.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2025-25193 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2025-25193" }, "action_statement": "Vulnerability CVE-2025-25193 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42579 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests. already_fixed \u2014 Target repository version 4.1.135.Final already contains the complete CVE-2026-42579 fix. All RFC 1035 validation checks (null byte rejection, label length <= 63, total length <= 255, empty middle label rejection) are present in both encodeDomainName() and decodeDomainName() methods. The fix was inherited when TuxCare onboarded upstream Netty 4.1.135.Final, which was released after the upstream...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42579" }, "impact_statement": "already_fixed \u2014 Target repository version 4.1.135.Final already contains the complete CVE-2026-42579 fix. All RFC 1035 validation checks (null byte rejection, label length <= 63, total length <= 255, empty middle label rejection) are present in both encodeDomainName() and decodeDomainName() methods. The fix was inherited when TuxCare onboarded upstream Netty 4.1.135.Final, which was released after the upstream..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests. already_fixed \u2014 CVE-2026-44249 has already been fixed in the target repository. The target code at version 4.1.135.Final contains both fixes from the vendor patch: (1) correct use of subnetMask in IPv6 address comparison at line 152, and (2) unsigned BigInteger interpretation at line 248. The fix was applied via the upstream commit 53c089fca9 and backported to earlier versions by TuxCare commit 86f341aa26.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44249" }, "impact_statement": "already_fixed \u2014 CVE-2026-44249 has already been fixed in the target repository. The target code at version 4.1.135.Final contains both fixes from the vendor patch: (1) correct use of subnetMask in IPv6 address comparison at line 152, and (2) unsigned BigInteger interpretation at line 248. The fix was applied via the upstream commit 53c089fca9 and backported to earlier versions by TuxCare commit 86f341aa26." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests. already_fixed \u2014 The target repository netty version 4.1.135.Final already contains the complete fix for CVE-2026-45416. The fix commit 829c885a45fd9f5ba43fe6caf296214b697366fa is present in the repository history and implements proper default limits (64KB max ClientHello length, 10-second timeout) to prevent unbounded memory allocation from malicious TLS ClientHello messages.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "already_fixed \u2014 The target repository netty version 4.1.135.Final already contains the complete fix for CVE-2026-45416. The fix commit 829c885a45fd9f5ba43fe6caf296214b697366fa is present in the repository history and implements proper default limits (64KB max ClientHello length, 10-second timeout) to prevent unbounded memory allocation from malicious TLS ClientHello messages." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45673 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests. already_fixed \u2014 The target repository (Netty 4.1.135.Final at SHA 445f793ae3) already contains the vendor security patch for CVE-2026-45673. Commit 06eb73d74c3075b35a21d882475c06ac41e8e57f, applied on 2026-06-01, replaced predictable ThreadLocalRandom with cryptographically secure SecureRandom for DNS transaction ID generation in DnsQueryIdSpace.java. This fix is an ancestor of the current HEAD and has not bee...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45673" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final at SHA 445f793ae3) already contains the vendor security patch for CVE-2026-45673. Commit 06eb73d74c3075b35a21d882475c06ac41e8e57f, applied on 2026-06-01, replaced predictable ThreadLocalRandom with cryptographically secure SecureRandom for DNS transaction ID generation in DnsQueryIdSpace.java. This fix is an ancestor of the current HEAD and has not bee..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45674 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains both bailiwick validation fixes for CVE-2026-45674. The CNAME bailiwick check was added in commit 5749d7822f and the NS bailiwick check in commit 6f19adf368, both present in the current HEAD. These fixes prevent DNS cache poisoning by validating that DNS resource records (CNAME and NS) originate from authoritative sources within the q...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45674" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains both bailiwick validation fixes for CVE-2026-45674. The CNAME bailiwick check was added in commit 5749d7822f and the NS bailiwick check in commit 6f19adf368, both present in the current HEAD. These fixes prevent DNS cache poisoning by validating that DNS resource records (CNAME and NS) originate from authoritative sources within the q..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47691 does not affect version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests. already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains both DNS Cache Poisoning fixes. Commits 6f19adf368 (NS record bailiwick validation) and 5749d7822f (CNAME bailiwick validation) were applied on June 2, 2026, as part of TuxCare ELS security backports. The bailiwick checks prevent subdomain authoritative servers from poisoning the cache for parent domains or unrelated zones.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47691" }, "impact_statement": "already_fixed \u2014 The target repository (Netty 4.1.135.Final) already contains both DNS Cache Poisoning fixes. Commits 6f19adf368 (NS record bailiwick validation) and 5749d7822f (CNAME bailiwick validation) were applied on June 2, 2026, as part of TuxCare ELS security backports. The bailiwick checks prevent subdomain authoritative servers from poisoning the cache for parent domains or unrelated zones." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-10-28T22:15:27.793370+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59901 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2026-59901" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-73508 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2026-73508" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-75596 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "CVE-2026-75596" }, "action_statement": "Vulnerability CVE-2026-75596 affects version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-transport-blockhound-tests@4.1.135.Final-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 is fixed in version 4.1.135.Final-tuxcare.1 of io.netty:netty-transport-blockhound-tests.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" } } ] }