{ "@id": "urn:uuid:1774c2f2-1919-4f31-88f5-b2796d9bf006", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-23T19:56:00.094720+00:00", "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:56:00.094720+00:00", "status_notes": "Vulnerability CVE-2019-16869 is fixed in version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2019-16869" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:56:00.094720+00:00", "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2019-20444" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2021-21295 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2021-21295" }, "action_statement": "Vulnerability CVE-2021-21295 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2021-21409 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2021-21409" }, "action_statement": "Vulnerability CVE-2021-21409 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:56:00.094720+00:00", "status_notes": "Vulnerability CVE-2021-37136 is fixed in version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2021-37136" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:56:00.094720+00:00", "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2021-37137" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:56:00.094720+00:00", "status_notes": "Vulnerability CVE-2022-41881 is fixed in version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2022-41881" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer. not_affected \u2014 Target version 4.1.21.Final is NOT affected by CVE-2023-34462. The vulnerability exists in SslClientHelloHandler, which was introduced AFTER this version (commit 8304069a30). The target uses AbstractSniHandler which parses ClientHello messages in-place without pre-allocating buffers based on the attacker-controlled handshake length field. The vulnerable code pattern (handshakeBuffer = ctx.alloc...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Target version 4.1.21.Final is NOT affected by CVE-2023-34462. The vulnerability exists in SslClientHelloHandler, which was introduced AFTER this version (commit 8304069a30). The target uses AbstractSniHandler which parses ClientHello messages in-place without pre-allocating buffers based on the attacker-controlled handshake length field. The vulnerable code pattern (handshakeBuffer = ctx.alloc..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-buffer 4.1.21.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:56:00.094720+00:00", "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2024-29025" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:56:00.094720+00:00", "status_notes": "Vulnerability CVE-2025-24970 is fixed in version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2025-24970" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2025-25193 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2025-25193" }, "action_statement": "Vulnerability CVE-2025-25193 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:56:00.094720+00:00", "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2025-55163" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:56:00.094720+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2025-59419 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2025-59419" }, "action_statement": "Vulnerability CVE-2025-59419 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-33871" }, "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-41417" }, "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-42578 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-42578" }, "action_statement": "Vulnerability CVE-2026-42578 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-42579 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-42579" }, "action_statement": "Vulnerability CVE-2026-42579 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer. not_affected \u2014 Target version 4.1.21.Final is NOT AFFECTED by CVE-2026-42580. The vulnerability affects versions that use manual byte-array accumulation for chunk size parsing (int overflow wraparound), but version 4.1.21.Final uses Java's standard Integer.parseInt(hex, 16) which validates integer range and throws NumberFormatException for values exceeding Integer.MAX_VALUE. The attack vector (malicious chunk...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Target version 4.1.21.Final is NOT AFFECTED by CVE-2026-42580. The vulnerability affects versions that use manual byte-array accumulation for chunk size parsing (int overflow wraparound), but version 4.1.21.Final uses Java's standard Integer.parseInt(hex, 16) which validates integer range and throws NumberFormatException for values exceeding Integer.MAX_VALUE. The attack vector (malicious chunk..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-42581" }, "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-42584" }, "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-42586 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-42586" }, "action_statement": "Vulnerability CVE-2026-42586 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer. Target version 4.1.21.Final is not affected by CVE-2026-42587. The vulnerability describes a bypass of the maxAllocation parameter when using Brotli, Zstd, or Snappy compression, but this version predates both features: (1) the maxAllocation parameter was added in a later commit (fa97ee929d \"Make public API specify explicit maxAllocation to prevent OOM\"), and (2) Brotli/Zstd/Snappy HTTP decompression support was added in even later versions (first appearing in 4.1.109+). Version 4.1.21.Final only supports gzip/deflate decompression without any maxAllocation parameter. The CVE's attack vector (configuring maxAllocation for protection, then bypassing it via Content-Encoding: br/zstd/snappy) cannot manifest because the prerequisite features don't exist.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "Target version 4.1.21.Final is not affected by CVE-2026-42587. The vulnerability describes a bypass of the maxAllocation parameter when using Brotli, Zstd, or Snappy compression, but this version predates both features: (1) the maxAllocation parameter was added in a later commit (fa97ee929d \"Make public API specify explicit maxAllocation to prevent OOM\"), and (2) Brotli/Zstd/Snappy HTTP decompression support was added in even later versions (first appearing in 4.1.109+). Version 4.1.21.Final only supports gzip/deflate decompression without any maxAllocation parameter. The CVE's attack vector (configuring maxAllocation for protection, then bypassing it via Content-Encoding: br/zstd/snappy) cannot manifest because the prerequisite features don't exist." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-44248 does not affect version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer. not_affected \u2014 CVE-2026-44248 affects MQTT 5 header Properties parsing, but Netty 4.1.21.Final only supports MQTT 3.1 and MQTT 3.1.1. MQTT 5 support was introduced in Netty 4.1.52.Final (commit be2cd68443, August 2020). The target version predates MQTT 5 support by 31 releases and cannot process MQTT 5 Properties sections. The MqttVersion enum contains only MQTT_3_1 and MQTT_3_1_1; any MQTT 5 connection attem...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44248" }, "impact_statement": "not_affected \u2014 CVE-2026-44248 affects MQTT 5 header Properties parsing, but Netty 4.1.21.Final only supports MQTT 3.1 and MQTT 3.1.1. MQTT 5 support was introduced in Netty 4.1.52.Final (commit be2cd68443, August 2020). The target version predates MQTT 5 support by 31 releases and cannot process MQTT 5 Properties sections. The MqttVersion enum contains only MQTT_3_1 and MQTT_3_1_1; any MQTT 5 connection attem..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer. Target version 4.1.21.Final is NOT AFFECTED by CVE-2026-44249. The CVE describes a vulnerability in the IpSubnetFilterRule.compareTo() method that uses networkAddress instead of subnetMask in a bitwise AND operation. Version 4.1.21.Final (released February 2018) does not have a compareTo() method - it was added 2.5 years later in September 2020. The target uses a matches() method that correctly applies subnetMask (line 156). While the target does have a signed BigInteger bug (line 170 missing unsigned parameter), this bug alone does not cause bypass vulnerabilities in the target's simpler code architecture where subnet masking is correctly implemented.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44249" }, "impact_statement": "Target version 4.1.21.Final is NOT AFFECTED by CVE-2026-44249. The CVE describes a vulnerability in the IpSubnetFilterRule.compareTo() method that uses networkAddress instead of subnetMask in a bitwise AND operation. Version 4.1.21.Final (released February 2018) does not have a compareTo() method - it was added 2.5 years later in September 2020. The target uses a matches() method that correctly applies subnetMask (line 156). While the target does have a signed BigInteger bug (line 170 missing unsigned parameter), this bug alone does not cause bypass vulnerabilities in the target's simpler code architecture where subnet masking is correctly implemented." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-44250 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-44250" }, "action_statement": "Vulnerability CVE-2026-44250 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-44890 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-44890" }, "action_statement": "Vulnerability CVE-2026-44890 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-44891 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-44891" }, "action_statement": "Vulnerability CVE-2026-44891 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-44893 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-44893" }, "action_statement": "Vulnerability CVE-2026-44893 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer. Netty version 4.1.21.Final is NOT AFFECTED by CVE-2026-45416. The vulnerability exists in SslClientHelloHandler.decode(), which handles multi-record TLS ClientHello messages by reading a 24-bit handshake length field and eagerly allocating ctx.alloc().buffer(handshakeLength). This class does not exist in version 4.1.21.Final. Instead, this version uses AbstractSniHandler (extending ByteToMessageDecoder directly) that parses ClientHello inline from the input buffer without reading the 24-bit handshake length field or performing eager allocation. The vulnerable code path was introduced in a later version when SslClientHelloHandler was added to support fragmented ClientHello messages. Backports of this CVE exist for versions 4.1.63.Final and later (which do have SslClientHelloHandler), but no backport exists for 4.1.21.Final, confirming it does not need the fix. The attack chain (multi-record ClientHello \u2192 read handshake length \u2192 eager allocation) is absent in this version.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Netty version 4.1.21.Final is NOT AFFECTED by CVE-2026-45416. The vulnerability exists in SslClientHelloHandler.decode(), which handles multi-record TLS ClientHello messages by reading a 24-bit handshake length field and eagerly allocating ctx.alloc().buffer(handshakeLength). This class does not exist in version 4.1.21.Final. Instead, this version uses AbstractSniHandler (extending ByteToMessageDecoder directly) that parses ClientHello inline from the input buffer without reading the 24-bit handshake length field or performing eager allocation. The vulnerable code path was introduced in a later version when SslClientHelloHandler was added to support fragmented ClientHello messages. Backports of this CVE exist for versions 4.1.63.Final and later (which do have SslClientHelloHandler), but no backport exists for 4.1.21.Final, confirming it does not need the fix. The attack chain (multi-record ClientHello \u2192 read handshake length \u2192 eager allocation) is absent in this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-45536 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-45536" }, "action_statement": "Vulnerability CVE-2026-45536 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-45673 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-45673" }, "action_statement": "Vulnerability CVE-2026-45673 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-45674 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-45674" }, "action_statement": "Vulnerability CVE-2026-45674 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:56:00.094720+00:00", "status_notes": "Vulnerability CVE-2026-46340 is fixed in version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-46340" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-47244" }, "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-47691 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-47691" }, "action_statement": "Vulnerability CVE-2026-47691 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-48006 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-48006" }, "action_statement": "Vulnerability CVE-2026-48006 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-48043 does not affect version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer. not_affected \u2014 Version 4.1.21.Final is not affected by CVE-2026-48043. The vulnerability exists in later versions that use a ChannelInboundHandlerAdapter pattern for decompression (introduced with Brotli support around 2021). Version 4.1.21.Final uses an older code structure where the main onDataRead method already wraps flow-controller operations in a try-finally block with buf.release() in the finally claus...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48043" }, "impact_statement": "not_affected \u2014 Version 4.1.21.Final is not affected by CVE-2026-48043. The vulnerability exists in later versions that use a ChannelInboundHandlerAdapter pattern for decompression (introduced with Brotli support around 2021). Version 4.1.21.Final uses an older code structure where the main onDataRead method already wraps flow-controller operations in a try-finally block with buf.release() in the finally claus..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-48059 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-48059" }, "action_statement": "Vulnerability CVE-2026-48059 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-50011 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-50011" }, "action_statement": "Vulnerability CVE-2026-50011 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-50020" }, "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-50560 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-50560" }, "action_statement": "Vulnerability CVE-2026-50560 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-55851" }, "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-56746 does not affect version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer. not_affected \u2014 The target version 4.1.21.Final is NOT AFFECTED by CVE-2026-56746. The vulnerability exists in a `getForOrigin()` method with flawed OR logic (`corsConfig.isNullOriginAllowed() || NULL_ORIGIN.equals(requestOrigin)`), but this method does not exist in version 4.1.21.Final. The vulnerable code was introduced 2+ months after 4.1.21.Final's release in commit 76c5f6cd03 (2018-04-11). The target uses...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56746" }, "impact_statement": "not_affected \u2014 The target version 4.1.21.Final is NOT AFFECTED by CVE-2026-56746. The vulnerability exists in a `getForOrigin()` method with flawed OR logic (`corsConfig.isNullOriginAllowed() || NULL_ORIGIN.equals(requestOrigin)`), but this method does not exist in version 4.1.21.Final. The vulnerable code was introduced 2+ months after 4.1.21.Final's release in commit 76c5f6cd03 (2018-04-11). The target uses..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-56817 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-56817" }, "action_statement": "Vulnerability CVE-2026-56817 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-56818 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-56818" }, "action_statement": "Vulnerability CVE-2026-56818 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-56819" }, "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-59900" }, "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-59901" }, "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-59902 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-59902" }, "action_statement": "Vulnerability CVE-2026-59902 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-59919 does not affect version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer. not_affected \u2014 Version 4.1.21.Final is not affected by CVE-2026-59919. While the target contains the data flaw (HAProxyMessage.checkAddress() lacks CRLF validation for AF_UNIX addresses at line 429-430), it completely lacks the encoding component required to reach the vulnerability goal. The HAProxyMessageEncoder class that serializes HAProxyMessage objects to wire format does not exist in this version - it w...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-59919" }, "impact_statement": "not_affected \u2014 Version 4.1.21.Final is not affected by CVE-2026-59919. While the target contains the data flaw (HAProxyMessage.checkAddress() lacks CRLF validation for AF_UNIX addresses at line 429-430), it completely lacks the encoding component required to reach the vulnerability goal. The HAProxyMessageEncoder class that serializes HAProxyMessage objects to wire format does not exist in this version - it w..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-59920 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-59920" }, "action_statement": "Vulnerability CVE-2026-59920 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-73507 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-73507" }, "action_statement": "Vulnerability CVE-2026-73507 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-73508 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-73508" }, "action_statement": "Vulnerability CVE-2026-73508 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer. Target version 4.1.21.Final (released Feb 2018) does not contain the vulnerable SslClientHelloHandler class, which was introduced in Feb 2020 (commit 8304069a30). The target uses AbstractSniHandler, a different implementation that does NOT accumulate ClientHello fragments across multiple TLS records and has no handshakeBuffer clear+recopy pattern. When a fragmented ClientHello arrives, AbstractSniHandler parses only the first TLS record; if incomplete, it falls back to the default SSL context and removes itself from the pipeline. No subsequent decode() calls occur, preventing any O(n\u00b2) re-copying. The ByteToMessageDecoder parent class cumulation is append-only with no clear() operation. The attack chain from fragmented input to quadratic CPU consumption does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "Target version 4.1.21.Final (released Feb 2018) does not contain the vulnerable SslClientHelloHandler class, which was introduced in Feb 2020 (commit 8304069a30). The target uses AbstractSniHandler, a different implementation that does NOT accumulate ClientHello fragments across multiple TLS records and has no handshakeBuffer clear+recopy pattern. When a fragmented ClientHello arrives, AbstractSniHandler parses only the first TLS record; if incomplete, it falls back to the default SSL context and removes itself from the pipeline. No subsequent decode() calls occur, preventing any O(n\u00b2) re-copying. The ByteToMessageDecoder parent class cumulation is append-only with no clear() operation. The attack chain from fragmented input to quadratic CPU consumption does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-buffer@4.1.21.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T19:55:16.559696+00:00", "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer.", "vulnerability": { "name": "GHSA-xpw8-rcwv-8f8p" }, "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.21.Final-tuxcare.1 of io.netty:netty-buffer." } ] }