{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:39039092-34a6-5331-bc51-8750888ba963", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "netty", "purl": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1", "type": "library", "group": "org.jboss.netty", "bom-ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1", "version": "3.2.4.Final-tuxcare.1", "pedigree": { "ancestors": [ { "name": "netty", "purl": "pkg:maven/org.jboss.netty/netty@3.2.4.Final", "type": "library", "group": "org.jboss.netty", "version": "3.2.4.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-3488", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:cf486bcd-4e06-5f9b-9fad-e08aff639643", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3488 affects version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty." } }, { "id": "CVE-2015-2156", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:058e92d5-e8ab-54d9-a9ec-50d3d86245c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2156 affects version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty." } }, { "id": "CVE-2019-16869", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d94ae198-186e-5932-9a55-f9f58f8446af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16869 affects version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty." } }, { "id": "CVE-2019-20444", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:df21758e-f6a1-5abb-9a87-ebcf4de0e35a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-20444 affects version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty." } }, { "id": "CVE-2019-20445", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:adc6d665-ab7f-5651-a4a3-2b2930f525ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-20445 affects version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty." } }, { "id": "CVE-2020-11612", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:373cd8c9-7ddf-5f53-9103-0f9fa62d5627", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-11612 affects version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty." } }, { "id": "CVE-2021-21290", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:89b0d94e-18c2-53aa-92f5-324d00ede78c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-21290 does not affect version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty. not_affected \u2014 Netty 3.2.4.Final is not affected by CVE-2021-21290. The vulnerable multipart upload handling code (AbstractDiskHttpData, HttpPostRequestDecoder, HttpPostMultiPartRequestDecoder) does not exist in this version. The multipart decoder functionality that creates temporary files with insecure permissions was introduced in later versions (3.7.0+, 4.1.x). This version predates the vulnerable feature ...", "justification": "code_not_present" } }, { "id": "CVE-2021-21295", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:746387a3-c0d1-5094-a68f-0bdc03df5ed4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-21295 does not affect version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty. not_affected \u2014 Netty 3.2.4.Final is not affected by CVE-2021-21295. This vulnerability requires HTTP/2 protocol support for HTTP/2-to-HTTP/1.1 request smuggling via malicious Content-Length headers. Netty 3.x (org.jboss.netty) does not have HTTP/2 support - HTTP/2 was added in Netty 4.x (io.netty) and standardized in RFC 7540 (2015), years after Netty 3.2.4 (2010). The target cannot receive HTTP/2 requests, s...", "justification": "code_not_present" } }, { "id": "CVE-2021-21409", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b042aacd-bc84-52a7-a45e-1906d8f5c50a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-21409 does not affect version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty. not_affected \u2014 CVE-2021-21409 does NOT affect Netty 3.2.4.Final. The vulnerability concerns HTTP/2 HEADERS frame validation in the codec-http2 module (io.netty.handler.codec.http2.DefaultHttp2ConnectionDecoder), which does not exist in Netty 3.x. Netty 3.2.4.Final was released circa 2010 and only supports HTTP/1.x. HTTP/2 support was introduced in Netty 4.x series after HTTP/2 was standardized (RFC 7540, 2015...", "justification": "code_not_present" } }, { "id": "CVE-2021-37136", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:4787abb9-897e-5249-bea2-f38179150fe5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-37136 does not affect version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty. Netty version 3.2.4.Final does not contain Bzip2 decompression functionality. The Bzip2Decoder class and all related decompression code identified in CVE-2021-37136 do not exist in this version. The compression package only supports Zlib/gzip/deflate, with a TODO comment explicitly noting \"// TODO Implement bzip2 and lzma handlers\". Git history confirms Bzip2Decoder was first implemented on 2014-06-17, more than 3 years after version 3.2.4.Final was released on 2011-02-07. Since the target cannot receive or process bzip2 compressed data, the vulnerability is not applicable.", "justification": "code_not_present" } }, { "id": "CVE-2021-37137", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f47b2d37-61f8-52d9-a100-afe62ac7e499", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-37137 does not affect version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty. CVE-2021-37137 affects SnappyFrameDecoder in Netty 4.x series (io.netty package). The target is Netty 3.2.4.Final from 2010 (org.jboss.netty package), which predates Snappy support. SnappyFrameDecoder and all Snappy-related code are absent from this version. The compression package contains only Zlib codecs (ZlibDecoder, ZlibEncoder). Exhaustive searches confirm zero Snappy references in source code, dependencies, or configuration. Rule 5 Type A1 satisfied: the INPUT (Snappy-framed compressed data chunks) cannot be received anywhere in the target codebase because the code to process it does not exist.", "justification": "code_not_present" } }, { "id": "CVE-2021-43797", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:55bc6840-f8c5-552a-9970-bac9c40fbaa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-43797 affects version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty." } }, { "id": "CVE-2022-24823", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:94389a81-34cd-57ee-82d6-a856b2d2c34c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-24823 does not affect version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty. not_affected \u2014 Netty 3.2.4.Final does not contain the vulnerable code. The CVE-2022-24823 vulnerability exists in Netty's multipart decoder and the PlatformDependent.createTempFile() utility (Netty 4.x) or DetectionUtil.createTempFile() utility (later Netty 3.x versions like 3.10.6). Version 3.2.4.Final predates this functionality entirely - it has no multipart form data handling, no file upload support, no t...", "justification": "code_not_present" } }, { "id": "CVE-2022-41881", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e689a105-ba0e-547c-9973-22e6626c3f93", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-41881 does not affect version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty. not_affected \u2014 Target Netty 3.2.4.Final (from 2010) predates the introduction of the HAProxy codec by 4 years. The vulnerable component (HAProxyMessage.readNextTLV recursive TLV parser) does not exist in this version. HAProxy codec was added to Netty in April 2014 (commit d7b2affe32) for Netty 4.x series, but this target is version 3.2.4.Final which has no HAProxy protocol parsing capabilities. Exhaustive sea...", "justification": "code_not_present" } }, { "id": "CVE-2023-34462", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bc5937a5-2443-55f5-98ca-be55f6b62e08", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34462 does not affect version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty. not_affected \u2014 Netty 3.2.4.Final is not affected by CVE-2023-34462. The vulnerable component (SniHandler) was introduced in Netty 4.x to support TLS Server Name Indication and does not exist in this version. Netty 3.2.4.Final delegates all TLS handshake processing to Java's SSLEngine and contains no code that parses ClientHello records in user-space or allocates ByteBuf based on untrusted ClientHello size fie...", "justification": "code_not_present" } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:dcd849b5-5279-5337-bf2a-42de1cfcdb42", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-44487 does not affect version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty. Netty 3.2.4.Final is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The target repository contains Netty 3.x (org.jboss.netty package), which predates the HTTP/2 protocol and has no HTTP/2 implementation. HTTP/2 support was introduced in Netty 4.1.0 (io.netty package) in 2016. The vulnerability specifically requires processing HTTP/2 RST_STREAM frames to cause resource exhaustion, but Netty 3.x only supports HTTP/1.x and cannot receive, parse, or process HTTP/2 frames. Exhaustive searches found zero HTTP/2-related code in the 539 Java source files. The git history shows CVE-2023-44487 was backported to Netty 4.1.x branches (4.1.43, 4.1.53, 4.1.80, 4.1.94, 4.1.99) but not to 3.2.4.Final, confirming TuxCare's assessment that this vulnerability is not applicable to Netty 3.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2024-29025", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:08744ea9-0bb6-54fb-ab4e-632ca1916428", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-29025 is a false positive for org.jboss.netty:netty 3.2.4.Final-tuxcare.1. false_positive \u2014 CVE-2024-29025 is a false positive for this repository. The CVE affects Netty 4.x (io.netty:netty-codec-http:* < 4.1.108.Final), but the target repository is Netty 3.x (org.jboss.netty:netty:3.2.4.Final). These are completely separate product lines with incompatible APIs and different package namespaces. The vulnerable component (HttpPostRequestDecoder with multipart support in io.netty.handler..." } }, { "id": "CVE-2024-47535", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:8c450266-edd1-561a-a65e-752f68f6bfd7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-47535 does not affect version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty. not_affected \u2014 Netty 3.2.4.Final is not affected by CVE-2024-47535. The vulnerable code pattern\u2014reading system configuration files (/etc/os-release, /usr/lib/os-release, /proc/sys/net/core/somaxconn) during library initialization without size limits\u2014does not exist in this version. The affected components (PlatformDependent.java, NetUtil.java, ResolvConf.java) were introduced in Netty 4.x as part of a major ar...", "justification": "code_not_present" } }, { "id": "CVE-2025-25193", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:617b1c07-dbaa-5459-a37f-4cf664f320b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-25193 does not affect version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty. not_affected \u2014 JBoss Netty 3.2.4.Final is not affected by CVE-2025-25193. The vulnerability concerns a bug in BoundedInputStream class introduced in Netty 4.x to protect against unbounded reading of environment files (os-release). JBoss Netty 3.x predates this feature entirely - it has no BoundedInputStream class, no environment file reading code, and uses a completely different package structure (org.jboss.n...", "justification": "code_not_present" } }, { "id": "CVE-2025-55163", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:8f308ed3-922d-5e9c-8b8e-90c2eff8b3ab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55163 does not affect version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty. Netty 3.2.4.Final does not have HTTP/2 protocol support. The MadeYouReset vulnerability (CVE-2025-55163) is specific to HTTP/2 implementations and exploits malformed HTTP/2 control frames (WINDOW_UPDATE, PRIORITY, frames on half-closed streams) to trigger unbounded server-sent RST_STREAM frames. Netty 3.x, released in 2010, predates HTTP/2 standardization (2015, RFC 7540) by 5 years and only supports HTTP/1.0 and HTTP/1.1. The target cannot receive or process the malicious INPUT (HTTP/2 control frames) required for exploitation. Type A1 satisfied: HTTP/2 input is not received anywhere in the codebase.", "justification": "code_not_present" } }, { "id": "CVE-2025-58056", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a61f64c9-404a-5a83-8df2-94243ad41111", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58056 affects version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty." } }, { "id": "CVE-2025-58057", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:4e2451c4-0476-5566-9b4c-e38c5d7964e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-58057 does not affect version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty. not_affected \u2014 Netty 3.2.4.Final is NOT AFFECTED by CVE-2025-58057. The vulnerability targets a specific architectural pattern in Netty 4.x: ByteToMessageDecoder with List-based buffer accumulation during decompression (BrotliDecoder, ZstdDecoder, JZlibDecoder, JdkZlibDecoder all calling output.add(pull()) in loops). Netty 3.x uses a fundamentally different architecture: OneToOneDecoder pattern where decoders...", "justification": "code_not_present" } }, { "id": "CVE-2025-67735", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:30f5dacf-15fa-52fd-91e8-0df51ec6f965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-67735 is fixed in version 3.2.4.Final-tuxcare.1 of org.jboss.netty:netty." } } ], "dependencies": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.1" } ] }