{ "@id": "urn:uuid:d92be6a5-44da-403f-bfcd-75b04db346c6", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-27T17:26:35.205079+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2014-0193 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2014-0193" }, "action_statement": "Vulnerability CVE-2014-0193 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2014-3488 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2014-3488" }, "action_statement": "Vulnerability CVE-2014-3488 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2015-2156 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2015-2156" }, "action_statement": "Vulnerability CVE-2015-2156 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2019-16869 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2019-16869" }, "action_statement": "Vulnerability CVE-2019-16869 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2019-20444 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2019-20444" }, "action_statement": "Vulnerability CVE-2019-20444 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:35.205079+00:00", "status_notes": "Vulnerability CVE-2021-21290 is fixed in version 3.6.2.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2021-21290" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2021-21295 does not affect version 3.6.2.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 CVE-2021-21295 affects HTTP/2\u2192HTTP/1.1 request smuggling via Content-Length validation bypass. Netty 3.6.2.Final does not have HTTP/2 support - it predates HTTP/2 protocol adoption and only supports HTTP/1.x. The vulnerable components (Http2MultiplexCodec, Http2FrameCodec, Http2StreamFrameToHttpObjectCodec, and the entire codec-http2 module) do not exist in this version. HTTP/2 support was intr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21295" }, "impact_statement": "not_affected \u2014 CVE-2021-21295 affects HTTP/2\u2192HTTP/1.1 request smuggling via Content-Length validation bypass. Netty 3.6.2.Final does not have HTTP/2 support - it predates HTTP/2 protocol adoption and only supports HTTP/1.x. The vulnerable components (Http2MultiplexCodec, Http2FrameCodec, Http2StreamFrameToHttpObjectCodec, and the entire codec-http2 module) do not exist in this version. HTTP/2 support was intr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2021-21409 does not affect version 3.6.2.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.6.2.Final is not affected by CVE-2021-21409. This CVE concerns HTTP/2 content-length header validation in the codec-http2 module's DefaultHttp2ConnectionDecoder class when a single HEADERS frame with endStream=true is received. Netty 3.x does not have HTTP/2 support - HTTP/2 was only added in Netty 4.1.x. The target repository contains only HTTP/1.x codec (org.jboss.netty.handler.codec....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21409" }, "impact_statement": "not_affected \u2014 Netty 3.6.2.Final is not affected by CVE-2021-21409. This CVE concerns HTTP/2 content-length header validation in the codec-http2 module's DefaultHttp2ConnectionDecoder class when a single HEADERS frame with endStream=true is received. Netty 3.x does not have HTTP/2 support - HTTP/2 was only added in Netty 4.1.x. The target repository contains only HTTP/1.x codec (org.jboss.netty.handler.codec...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2021-37136 does not affect version 3.6.2.Final-tuxcare.1 of io.netty:netty. Netty 3.6.2.Final does not contain Bzip2 decompression functionality. CVE-2021-37136 affects Bzip2Decoder in Netty 4.x, but this version (3.x) predates Bzip2 support. The compression codec directory contains only Zlib-based decompression (ZlibDecoder for deflate/gzip). A TODO comment in package-info.java explicitly states \"TODO Implement bzip2 and lzma handlers\", confirming Bzip2 was planned but never implemented in the 3.x branch. Exhaustive searches found zero Bzip2-related code, classes, or dependencies. The vulnerability pattern cannot exist because the affected component (Bzip2Decoder and related classes) is entirely absent from this codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-37136" }, "impact_statement": "Netty 3.6.2.Final does not contain Bzip2 decompression functionality. CVE-2021-37136 affects Bzip2Decoder in Netty 4.x, but this version (3.x) predates Bzip2 support. The compression codec directory contains only Zlib-based decompression (ZlibDecoder for deflate/gzip). A TODO comment in package-info.java explicitly states \"TODO Implement bzip2 and lzma handlers\", confirming Bzip2 was planned but never implemented in the 3.x branch. Exhaustive searches found zero Bzip2-related code, classes, or dependencies. The vulnerability pattern cannot exist because the affected component (Bzip2Decoder and related classes) is entirely absent from this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2021-37137 does not affect version 3.6.2.Final-tuxcare.1 of io.netty:netty. Netty 3.6.2.Final is NOT AFFECTED by CVE-2021-37137. The vulnerable SnappyFrameDecoder class does not exist in this version. Snappy compression support was introduced in Netty 4.0.0.Beta1 development cycle, long after the 3.6.2.Final release. The target version only supports Zlib compression and has no capability to receive or process Snappy frame data. This satisfies Rule 5 Type A1 (input absent): the Brief's INPUT (Snappy frame data chunks) is not received anywhere in the target codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-37137" }, "impact_statement": "Netty 3.6.2.Final is NOT AFFECTED by CVE-2021-37137. The vulnerable SnappyFrameDecoder class does not exist in this version. Snappy compression support was introduced in Netty 4.0.0.Beta1 development cycle, long after the 3.6.2.Final release. The target version only supports Zlib compression and has no capability to receive or process Snappy frame data. This satisfies Rule 5 Type A1 (input absent): the Brief's INPUT (Snappy frame data chunks) is not received anywhere in the target codebase." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2022-41881 does not affect version 3.6.2.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.6.2.Final is not affected by CVE-2022-41881. The vulnerable HAProxy codec (io.netty.handler.codec.haproxy) does not exist in this version. The HAProxy protocol decoder was introduced to Netty 4.x on 2014-04-22, over a year after Netty 3.6.2.Final was released (2013-01-16). This version uses the org.jboss.netty package structure (Netty 3.x lineage), while HAProxy codec was introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41881" }, "impact_statement": "not_affected \u2014 Netty 3.6.2.Final is not affected by CVE-2022-41881. The vulnerable HAProxy codec (io.netty.handler.codec.haproxy) does not exist in this version. The HAProxy protocol decoder was introduced to Netty 4.x on 2014-04-22, over a year after Netty 3.6.2.Final was released (2013-01-16). This version uses the org.jboss.netty package structure (Netty 3.x lineage), while HAProxy codec was introduced in ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 3.6.2.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.6.2.Final is not affected by CVE-2023-34462. The vulnerability requires the SniHandler class which manually parses ClientHello handshake messages and allocates ByteBuf based on an attacker-controlled 3-byte handshake length field (up to 16MB). This class was introduced in Netty 4.x and does not exist in Netty 3.6.2.Final. The 3.x SslHandler only reads TLS record headers (2-byte length, ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Netty 3.6.2.Final is not affected by CVE-2023-34462. The vulnerability requires the SniHandler class which manually parses ClientHello handshake messages and allocates ByteBuf based on an attacker-controlled 3-byte handshake length field (up to 16MB). This class was introduced in Netty 4.x and does not exist in Netty 3.6.2.Final. The 3.x SslHandler only reads TLS record headers (2-byte length, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2023-44487 does not affect version 3.6.2.Final-tuxcare.1 of io.netty:netty. Netty 3.6.2.Final is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). This version predates HTTP/2 support entirely\u2014HTTP/2 was introduced in Netty 4.1.x (2015), years after Netty 3.6.2.Final (2012). The target implements only HTTP/1.x, SPDY, WebSocket, and other protocols but has no HTTP/2 codec. The vulnerability's input type (HTTP/2 RST_STREAM frames) cannot be received by this codebase. Rule 5 Type A1 satisfied: exhaustive search confirms HTTP/2 protocol implementation is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-44487" }, "impact_statement": "Netty 3.6.2.Final is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). This version predates HTTP/2 support entirely\u2014HTTP/2 was introduced in Netty 4.1.x (2015), years after Netty 3.6.2.Final (2012). The target implements only HTTP/1.x, SPDY, WebSocket, and other protocols but has no HTTP/2 codec. The vulnerability's input type (HTTP/2 RST_STREAM frames) cannot be received by this codebase. Rule 5 Type A1 satisfied: exhaustive search confirms HTTP/2 protocol implementation is absent." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2024-29025 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2024-29025" }, "action_statement": "Vulnerability CVE-2024-29025 affects version 3.6.2.Final-tuxcare.1 of io.netty:netty." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2024-47535 does not affect version 3.6.2.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.6.2.Final is not affected by CVE-2024-47535. The vulnerable code paths that read system configuration files (/etc/os-release, /usr/lib/os-release, /proc/sys/net/core/somaxconn, /etc/resolv.conf) during initialization exist only in Netty 4.1.x and were never present in Netty 3.x. The target uses the org.jboss.netty.* package namespace and has a fundamentally different architecture from N...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-47535" }, "impact_statement": "not_affected \u2014 Netty 3.6.2.Final is not affected by CVE-2024-47535. The vulnerable code paths that read system configuration files (/etc/os-release, /usr/lib/os-release, /proc/sys/net/core/somaxconn, /etc/resolv.conf) during initialization exist only in Netty 4.1.x and were never present in Netty 3.x. The target uses the org.jboss.netty.* package namespace and has a fundamentally different architecture from N..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2025-25193 does not affect version 3.6.2.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty version 3.6.2.Final is not affected by CVE-2025-25193. The vulnerable code pattern does not exist in this version. The vulnerability concerns BoundedInputStream, a class introduced in Netty 4.x to protect against unbounded reads when loading system files (e.g., /proc/sys/net/core/somaxconn on Linux/Windows). Version 3.6.2.Final predates this functionality: (1) BoundedInputStream class doe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-25193" }, "impact_statement": "not_affected \u2014 Netty version 3.6.2.Final is not affected by CVE-2025-25193. The vulnerable code pattern does not exist in this version. The vulnerability concerns BoundedInputStream, a class introduced in Netty 4.x to protect against unbounded reads when loading system files (e.g., /proc/sys/net/core/somaxconn on Linux/Windows). Version 3.6.2.Final predates this functionality: (1) BoundedInputStream class doe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:05.856633+00:00", "status_notes": "Vulnerability CVE-2025-55163 does not affect version 3.6.2.Final-tuxcare.1 of io.netty:netty. The target (Netty 3.6.2.Final) is not affected by CVE-2025-55163 (MadeYouReset HTTP/2 vulnerability). This CVE targets HTTP/2 protocol implementations, specifically the handling of malformed HTTP/2 control frames that trigger excessive RST_STREAM responses. Netty 3.x predates HTTP/2 support entirely\u2014HTTP/2 codec was only introduced in Netty 4.1.x (circa 2015). The target has HTTP/1.x and SPDY support but does not receive, parse, or process HTTP/2 frames. Exhaustive searches confirmed zero HTTP/2 code (no codec-http2 module, no io.netty.handler.codec.http2 package, no HTTP/2 dependencies). The vendor patches modify HTTP/2-specific classes (Http2MaxRstFrameLimitEncoder, Http2ConnectionHandler) that do not exist in Netty 3.x's org.jboss.netty package structure.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-55163" }, "impact_statement": "The target (Netty 3.6.2.Final) is not affected by CVE-2025-55163 (MadeYouReset HTTP/2 vulnerability). This CVE targets HTTP/2 protocol implementations, specifically the handling of malformed HTTP/2 control frames that trigger excessive RST_STREAM responses. Netty 3.x predates HTTP/2 support entirely\u2014HTTP/2 codec was only introduced in Netty 4.1.x (circa 2015). The target has HTTP/1.x and SPDY support but does not receive, parse, or process HTTP/2 frames. Exhaustive searches confirmed zero HTTP/2 code (no codec-http2 module, no io.netty.handler.codec.http2 package, no HTTP/2 dependencies). The vendor patches modify HTTP/2-specific classes (Http2MaxRstFrameLimitEncoder, Http2ConnectionHandler) that do not exist in Netty 3.x's org.jboss.netty package structure." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:35.205079+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 3.6.2.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:35.205079+00:00", "status_notes": "Vulnerability CVE-2025-58057 is fixed in version 3.6.2.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2025-58057" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.6.2.Final-tuxcare.1" } } ], "timestamp": "2026-10-27T17:26:35.205079+00:00", "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 3.6.2.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2025-67735" } } ] }