{ "@id": "urn:uuid:7e5ce71a-b171-4e5d-9cb3-3cb2978b7fc7", "role": "Document Creator", "author": "https://tuxcare.com", "version": 3, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-23T09:47:13.666749+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2019-16869 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2019-16869" }, "action_statement": "Vulnerability CVE-2019-16869 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2019-20444 is fixed in version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2019-20444" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2020-7238 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2020-7238" }, "action_statement": "Vulnerability CVE-2020-7238 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2021-21290 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2021-21290" }, "action_statement": "Vulnerability CVE-2021-21290 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2021-21295 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2021-21295" }, "action_statement": "Vulnerability CVE-2021-21295 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2021-21409 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2021-21409" }, "action_statement": "Vulnerability CVE-2021-21409 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2021-37136 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2021-37136" }, "action_statement": "Vulnerability CVE-2021-37136 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2021-37137 is fixed in version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2021-37137" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:47:13.666749+00:00", "status_notes": "Vulnerability CVE-2022-41881 is fixed in version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2022-41881" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy. not_affected \u2014 Version 4.1.24.Final is NOT affected by CVE-2023-34462. The vulnerable code (handshakeBuffer allocation based on unchecked 3-byte handshake length) was introduced in version 4.1.44.Final (November 2019), over 18 months after 4.1.24.Final was released (April 2018). The target version parses ClientHello in-place without allocating buffers based on the attacker-controlled handshake length field, m...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Version 4.1.24.Final is NOT affected by CVE-2023-34462. The vulnerable code (handshakeBuffer allocation based on unchecked 3-byte handshake length) was introduced in version 4.1.44.Final (November 2019), over 18 months after 4.1.24.Final was released (April 2018). The target version parses ClientHello in-place without allocating buffers based on the attacker-controlled handshake length field, m..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2023-4586 is a false positive for io.netty:netty-handler-proxy 4.1.24.Final-tuxcare.1.", "vulnerability": { "name": "CVE-2023-4586" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2024-29025 is fixed in version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2024-29025" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2024-47535 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2024-47535" }, "action_statement": "Vulnerability CVE-2024-47535 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2025-24970 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2025-24970" }, "action_statement": "Vulnerability CVE-2025-24970 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2025-25193 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy. not_affected \u2014 Version 4.1.24.Final is not affected by CVE-2025-25193. The vulnerable component (BoundedInputStream class) and the vulnerable feature (os-release file reading on Windows) do not exist in this version. These were introduced in Netty 4.1.46.Final (February 2020) and later, approximately 2 years after version 4.1.24.Final was released. Git history analysis confirms that commit 713e0aa68a introduc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-25193" }, "impact_statement": "not_affected \u2014 Version 4.1.24.Final is not affected by CVE-2025-25193. The vulnerable component (BoundedInputStream class) and the vulnerable feature (os-release file reading on Windows) do not exist in this version. These were introduced in Netty 4.1.46.Final (February 2020) and later, approximately 2 years after version 4.1.24.Final was released. Git history analysis confirms that commit 713e0aa68a introduc..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:45.566734+00:00", "status_notes": "Vulnerability CVE-2025-55163 is fixed in version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2025-55163" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2025-58057 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2025-58057" }, "action_statement": "Vulnerability CVE-2025-58057 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2025-59419 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2025-59419" }, "action_statement": "Vulnerability CVE-2025-59419 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2025-67735 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2025-67735" }, "action_statement": "Vulnerability CVE-2025-67735 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-33870 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-33870" }, "action_statement": "Vulnerability CVE-2026-33870 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-33871 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-33871" }, "action_statement": "Vulnerability CVE-2026-33871 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-41417 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-41417" }, "action_statement": "Vulnerability CVE-2026-41417 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-42578 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-42578" }, "action_statement": "Vulnerability CVE-2026-42578 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-42579 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-42579" }, "action_statement": "Vulnerability CVE-2026-42579 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-42580 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy. not_affected \u2014 Version 4.1.24.Final is NOT affected by CVE-2026-42580. This version uses String-based chunk size parsing via Integer.parseInt(hex, 16) which inherently throws NumberFormatException for overflow values. The vulnerable manual byte[]-based parsing implementation with inadequate overflow checking (present in later versions 4.1.94+) does not exist in this version. Integer.parseInt provides built-in...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42580" }, "impact_statement": "not_affected \u2014 Version 4.1.24.Final is NOT affected by CVE-2026-42580. This version uses String-based chunk size parsing via Integer.parseInt(hex, 16) which inherently throws NumberFormatException for overflow values. The vulnerable manual byte[]-based parsing implementation with inadequate overflow checking (present in later versions 4.1.94+) does not exist in this version. Integer.parseInt provides built-in..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-42581 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-42581" }, "action_statement": "Vulnerability CVE-2026-42581 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-42583 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-42583" }, "action_statement": "Vulnerability CVE-2026-42583 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-42584 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-42584" }, "action_statement": "Vulnerability CVE-2026-42584 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-42585 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-42585" }, "action_statement": "Vulnerability CVE-2026-42585 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-42586 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-42586" }, "action_statement": "Vulnerability CVE-2026-42586 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-42587 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy. Version 4.1.24.Final is not affected by CVE-2026-42587. The vulnerability requires both maxAllocation parameter support AND br/zstd/snappy decompression capabilities. Version 4.1.24.Final has neither: (1) HttpContentDecompressor and DelegatingDecompressorFrameListener only support gzip/deflate encodings, returning null for unsupported encodings; (2) BrotliDecoder and ZstdDecoder classes do not exist; (3) SnappyFrameDecoder exists but is not integrated into HTTP decompression handlers; (4) the maxAllocation parameter does not exist in this version (introduced later in commit fa97ee929d). The attack chain is broken: while HTTP requests with Content-Encoding br/zstd/snappy can be received, they are not decompressed, so unbounded memory allocation through decompression cannot occur. This version predates both the vulnerable feature (br/zstd/snappy support without maxAllocation enforcement) and the protection mechanism (maxAllocation parameter itself).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42587" }, "impact_statement": "Version 4.1.24.Final is not affected by CVE-2026-42587. The vulnerability requires both maxAllocation parameter support AND br/zstd/snappy decompression capabilities. Version 4.1.24.Final has neither: (1) HttpContentDecompressor and DelegatingDecompressorFrameListener only support gzip/deflate encodings, returning null for unsupported encodings; (2) BrotliDecoder and ZstdDecoder classes do not exist; (3) SnappyFrameDecoder exists but is not integrated into HTTP decompression handlers; (4) the maxAllocation parameter does not exist in this version (introduced later in commit fa97ee929d). The attack chain is broken: while HTTP requests with Content-Encoding br/zstd/snappy can be received, they are not decompressed, so unbounded memory allocation through decompression cannot occur. This version predates both the vulnerable feature (br/zstd/snappy support without maxAllocation enforcement) and the protection mechanism (maxAllocation parameter itself)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-44248 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy. not_affected \u2014 The target Netty version 4.1.24.Final does not support MQTT 5 protocol and therefore cannot process MQTT 5 Properties, which are the specific input type required to trigger CVE-2026-44248. The vulnerability is specific to unbounded parsing of MQTT 5 Properties sections in variable headers, but this version only implements MQTT 3.1 and MQTT 3.1.1, which lack the extensible Properties mechanism. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44248" }, "impact_statement": "not_affected \u2014 The target Netty version 4.1.24.Final does not support MQTT 5 protocol and therefore cannot process MQTT 5 Properties, which are the specific input type required to trigger CVE-2026-44248. The vulnerability is specific to unbounded parsing of MQTT 5 Properties sections in variable headers, but this version only implements MQTT 3.1 and MQTT 3.1.1, which lack the extensible Properties mechanism. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-44249 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy. Version 4.1.24.Final is not affected by CVE-2026-44249. The vulnerable compareTo(InetSocketAddress) method described in the CVE was introduced in September 2020 (commit a49afaef35), more than 2 years after the release of 4.1.24.Final in April 2018. This version uses only the matches() method for IPv6 subnet filtering, which correctly applies the subnet mask. The binary search-based IpSubnetFilter class that relies on compareTo does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44249" }, "impact_statement": "Version 4.1.24.Final is not affected by CVE-2026-44249. The vulnerable compareTo(InetSocketAddress) method described in the CVE was introduced in September 2020 (commit a49afaef35), more than 2 years after the release of 4.1.24.Final in April 2018. This version uses only the matches() method for IPv6 subnet filtering, which correctly applies the subnet mask. The binary search-based IpSubnetFilter class that relies on compareTo does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-44250 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-44250" }, "action_statement": "Vulnerability CVE-2026-44250 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-44890 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-44890" }, "action_statement": "Vulnerability CVE-2026-44890 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-44891 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-44891" }, "action_statement": "Vulnerability CVE-2026-44891 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-44893 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-44893" }, "action_statement": "Vulnerability CVE-2026-44893 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-45416 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy. Version 4.1.24.Final does not contain the vulnerable SslClientHelloHandler class. CVE-2026-45416 concerns SslClientHelloHandler.decode() which eagerly allocates buffers based on attacker-controlled handshake length when maxClientHelloLength=0. However, SslClientHelloHandler was introduced in February 2020 (commit 8304069a30), almost 2 years after 4.1.24.Final was released in April 2018. The target version uses AbstractSniHandler with a fundamentally different implementation that processes ClientHello messages inline within the existing ByteBuf without allocating new buffers based on handshake length. The vulnerable code pattern (ctx.alloc().buffer(handshakeLength)) does not exist anywhere in the SSL handler code of this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45416" }, "impact_statement": "Version 4.1.24.Final does not contain the vulnerable SslClientHelloHandler class. CVE-2026-45416 concerns SslClientHelloHandler.decode() which eagerly allocates buffers based on attacker-controlled handshake length when maxClientHelloLength=0. However, SslClientHelloHandler was introduced in February 2020 (commit 8304069a30), almost 2 years after 4.1.24.Final was released in April 2018. The target version uses AbstractSniHandler with a fundamentally different implementation that processes ClientHello messages inline within the existing ByteBuf without allocating new buffers based on handshake length. The vulnerable code pattern (ctx.alloc().buffer(handshakeLength)) does not exist anywhere in the SSL handler code of this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-45536 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-45536" }, "action_statement": "Vulnerability CVE-2026-45536 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-45673 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-45673" }, "action_statement": "Vulnerability CVE-2026-45673 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-45674 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy. Version 4.1.24.Final is not affected by CVE-2026-45674 because the vulnerable component (DnsCnameCache) does not exist in this version. The CVE targets DNS cache poisoning via unvalidated CNAME records being cached persistently. While 4.1.24 does process CNAME records in the buildAliasMap method without bailiwick validation, it only creates a transient HashMap scoped to a single resolution\u2014there is no persistent CNAME cache to poison. The DnsCnameCache feature and associated caching logic were introduced in later versions (4.1.52+), which is why those versions received CVE-2026-45674 backports while 4.1.24 did not.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45674" }, "impact_statement": "Version 4.1.24.Final is not affected by CVE-2026-45674 because the vulnerable component (DnsCnameCache) does not exist in this version. The CVE targets DNS cache poisoning via unvalidated CNAME records being cached persistently. While 4.1.24 does process CNAME records in the buildAliasMap method without bailiwick validation, it only creates a transient HashMap scoped to a single resolution\u2014there is no persistent CNAME cache to poison. The DnsCnameCache feature and associated caching logic were introduced in later versions (4.1.52+), which is why those versions received CVE-2026-45674 backports while 4.1.24 did not." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-46340 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-46340" }, "action_statement": "Vulnerability CVE-2026-46340 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-47244 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-47244" }, "action_statement": "Vulnerability CVE-2026-47244 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-47691 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-47691" }, "action_statement": "Vulnerability CVE-2026-47691 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-48006 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-48006" }, "action_statement": "Vulnerability CVE-2026-48006 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-48043 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-48043" }, "action_statement": "Vulnerability CVE-2026-48043 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-48059 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-48059" }, "action_statement": "Vulnerability CVE-2026-48059 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-50010 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-50010" }, "action_statement": "Vulnerability CVE-2026-50010 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-50011 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-50011" }, "action_statement": "Vulnerability CVE-2026-50011 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-50020 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-50020" }, "action_statement": "Vulnerability CVE-2026-50020 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-50560 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-50560" }, "action_statement": "Vulnerability CVE-2026-50560 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-55831 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-55831" }, "action_statement": "Vulnerability CVE-2026-55831 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-55833 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-55833" }, "action_statement": "Vulnerability CVE-2026-55833 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-55851 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-55851" }, "action_statement": "Vulnerability CVE-2026-55851 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-56745 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-56745" }, "action_statement": "Vulnerability CVE-2026-56745 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-56746 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-56746" }, "action_statement": "Vulnerability CVE-2026-56746 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-56817 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-56817" }, "action_statement": "Vulnerability CVE-2026-56817 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-56818 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-56818" }, "action_statement": "Vulnerability CVE-2026-56818 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-56819 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-56819" }, "action_statement": "Vulnerability CVE-2026-56819 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-59898 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-59898" }, "action_statement": "Vulnerability CVE-2026-59898 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-59899 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-59899" }, "action_statement": "Vulnerability CVE-2026-59899 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-59900 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-59900" }, "action_statement": "Vulnerability CVE-2026-59900 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-59901 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-59901" }, "action_statement": "Vulnerability CVE-2026-59901 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-59902 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-59902" }, "action_statement": "Vulnerability CVE-2026-59902 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-59903 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-59903" }, "action_statement": "Vulnerability CVE-2026-59903 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-59919 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy. not_affected \u2014 Target Netty version 4.1.24.Final is not affected by CVE-2026-59919. The vulnerable component HAProxyMessageEncoder that writes AF_UNIX addresses to HAProxy V1 protocol output does not exist in this version. It was added in commit 9ac005222b on 2020-04-16, approximately 2 years after the 4.1.24.Final release. The target only has decoding capability (HAProxyMessageDecoder) and cannot generate V1...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59919" }, "impact_statement": "not_affected \u2014 Target Netty version 4.1.24.Final is not affected by CVE-2026-59919. The vulnerable component HAProxyMessageEncoder that writes AF_UNIX addresses to HAProxy V1 protocol output does not exist in this version. It was added in commit 9ac005222b on 2020-04-16, approximately 2 years after the 4.1.24.Final release. The target only has decoding capability (HAProxyMessageDecoder) and cannot generate V1..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-59920 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-59920" }, "action_statement": "Vulnerability CVE-2026-59920 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-59921 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-59921" }, "action_statement": "Vulnerability CVE-2026-59921 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-73507 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-73507" }, "action_statement": "Vulnerability CVE-2026-73507 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-73508 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-73508" }, "action_statement": "Vulnerability CVE-2026-73508 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-75595 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "CVE-2026-75595" }, "action_statement": "Vulnerability CVE-2026-75595 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability CVE-2026-75596 does not affect version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy. Netty 4.1.24.Final is NOT AFFECTED by CVE-2026-75596. The vulnerable code (SslClientHelloHandler with quadratic buffer re-aggregation) does not exist in this version. SslClientHelloHandler was introduced nearly 2 years after 4.1.24.Final's release (commit 8304069a30 on 2020-02-05 vs 04fac00c8c on 2018-04-19). The version uses AbstractSniHandler which parses ClientHello in-place without buffer re-copying, achieving O(n) complexity instead of the O(n\u00b2) behavior described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-75596" }, "impact_statement": "Netty 4.1.24.Final is NOT AFFECTED by CVE-2026-75596. The vulnerable code (SslClientHelloHandler with quadratic buffer re-aggregation) does not exist in this version. SslClientHelloHandler was introduced nearly 2 years after 4.1.24.Final's release (commit 8304069a30 on 2020-02-05 vs 04fac00c8c on 2018-04-19). The version uses AbstractSniHandler which parses ClientHello in-place without buffer re-copying, achieving O(n) complexity instead of the O(n\u00b2) behavior described in the CVE." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "GHSA-mfg7-5gfp-c4w3" }, "action_statement": "Vulnerability GHSA-mfg7-5gfp-c4w3 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "GHSA-v74w-7mr3-4qg3" }, "action_statement": "Vulnerability GHSA-v74w-7mr3-4qg3 affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty-handler-proxy@4.1.24.Final-tuxcare.1" } } ], "timestamp": "2026-10-23T09:46:43.826767+00:00", "status_notes": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy.", "vulnerability": { "name": "GHSA-xpw8-rcwv-8f8p" }, "action_statement": "Vulnerability GHSA-xpw8-rcwv-8f8p affects version 4.1.24.Final-tuxcare.1 of io.netty:netty-handler-proxy." } ] }