{ "@id": "urn:uuid:eae25dea-2221-44c3-9449-2d4d8047850b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-22T16:13:24.840809+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2014-0193 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2014-0193" }, "action_statement": "Vulnerability CVE-2014-0193 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2014-3488 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2014-3488" }, "action_statement": "Vulnerability CVE-2014-3488 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2015-2156 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2015-2156" }, "action_statement": "Vulnerability CVE-2015-2156 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2019-16869 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2019-16869" }, "action_statement": "Vulnerability CVE-2019-16869 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2019-20444 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2019-20444" }, "action_statement": "Vulnerability CVE-2019-20444 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2021-21290 is fixed in version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2021-21290" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2021-21295 does not affect version 3.5.13.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.5.13.Final does not support HTTP/2 protocol. CVE-2021-21295 requires HTTP/2-to-HTTP/1.1 conversion via Http2StreamFrameToHttpObjectCodec, which does not exist in this version. HTTP/2 support was introduced in Netty 4.1.x. The vulnerability's attack chain (HTTP/2 request with malicious Content-Length \u2192 conversion to HTTP/1.1 \u2192 request smuggling) cannot occur without HTTP/2 infrastructure...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21295" }, "impact_statement": "not_affected \u2014 Netty 3.5.13.Final does not support HTTP/2 protocol. CVE-2021-21295 requires HTTP/2-to-HTTP/1.1 conversion via Http2StreamFrameToHttpObjectCodec, which does not exist in this version. HTTP/2 support was introduced in Netty 4.1.x. The vulnerability's attack chain (HTTP/2 request with malicious Content-Length \u2192 conversion to HTTP/1.1 \u2192 request smuggling) cannot occur without HTTP/2 infrastructure..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2021-21409 does not affect version 3.5.13.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 The target (Netty 3.5.13.Final) is not affected by CVE-2021-21409. This vulnerability is specific to HTTP/2 content-length header validation in Netty 4.x (io.netty.handler.codec.http2.DefaultHttp2ConnectionDecoder). Netty 3.x uses the org.jboss.netty package structure and only supports HTTP/1.x; it has no HTTP/2 codec implementation. The vulnerable component (HTTP/2 HEADERS frame processor) doe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21409" }, "impact_statement": "not_affected \u2014 The target (Netty 3.5.13.Final) is not affected by CVE-2021-21409. This vulnerability is specific to HTTP/2 content-length header validation in Netty 4.x (io.netty.handler.codec.http2.DefaultHttp2ConnectionDecoder). Netty 3.x uses the org.jboss.netty package structure and only supports HTTP/1.x; it has no HTTP/2 codec implementation. The vulnerable component (HTTP/2 HEADERS frame processor) doe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2021-37136 does not affect version 3.5.13.Final-tuxcare.1 of io.netty:netty. Netty 3.5.13.Final (released June 2013) does not contain Bzip2 decompression functionality. CVE-2021-37136 affects Bzip2Decoder, which was first implemented in Netty 4.1.0.Beta1 timeframe (June 2014), one full year after this version's release. The target version predates the vulnerable feature entirely. The compression package contains only Zlib support (ZlibDecoder, ZlibEncoder), and package-info.java explicitly states \"TODO Implement bzip2 and lzma handlers\" (line 28). No Bzip2-related code, dependencies, or input handlers exist in the codebase. This is a clear Rule 5 Type A1 case: the Brief's INPUT (Bzip2 compressed data stream with attacker-controlled block length metadata) is not received anywhere in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-37136" }, "impact_statement": "Netty 3.5.13.Final (released June 2013) does not contain Bzip2 decompression functionality. CVE-2021-37136 affects Bzip2Decoder, which was first implemented in Netty 4.1.0.Beta1 timeframe (June 2014), one full year after this version's release. The target version predates the vulnerable feature entirely. The compression package contains only Zlib support (ZlibDecoder, ZlibEncoder), and package-info.java explicitly states \"TODO Implement bzip2 and lzma handlers\" (line 28). No Bzip2-related code, dependencies, or input handlers exist in the codebase. This is a clear Rule 5 Type A1 case: the Brief's INPUT (Bzip2 compressed data stream with attacker-controlled block length metadata) is not received anywhere in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2021-37137 does not affect version 3.5.13.Final-tuxcare.1 of io.netty:netty. Netty 3.5.13.Final does not contain any Snappy compression support. The vulnerable SnappyFrameDecoder class and all related Snappy codec components (Snappy.java, SnappyFrameDecoder.java) do not exist in this version. Snappy support was introduced exclusively in Netty 4.0.0.Alpha8 (December 2012) and never backported to the 3.x line. Exhaustive verification across multiple Netty 3.x versions (3.5.13, 3.7.0, 3.9.0, 3.10.6) confirms only Zlib compression codecs exist in the 3.x series. The target cannot process Snappy frame data, therefore the CVE-2021-37137 memory exhaustion vulnerability cannot be triggered.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-37137" }, "impact_statement": "Netty 3.5.13.Final does not contain any Snappy compression support. The vulnerable SnappyFrameDecoder class and all related Snappy codec components (Snappy.java, SnappyFrameDecoder.java) do not exist in this version. Snappy support was introduced exclusively in Netty 4.0.0.Alpha8 (December 2012) and never backported to the 3.x line. Exhaustive verification across multiple Netty 3.x versions (3.5.13, 3.7.0, 3.9.0, 3.10.6) confirms only Zlib compression codecs exist in the 3.x series. The target cannot process Snappy frame data, therefore the CVE-2021-37137 memory exhaustion vulnerability cannot be triggered." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2022-41881 does not affect version 3.5.13.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty version 3.5.13.Final does not contain the HAProxy codec module. CVE-2022-41881 affects HAProxyMessageDecoder, which was introduced in Netty 4.x series. Version 3.5.13.Final uses the org.jboss.netty package namespace (Netty 3.x series) and includes only base64, compression, frame, HTTP, marshalling, protobuf, RTSP, serialization, SPDY, and string codecs. No HAProxy protocol support exists ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41881" }, "impact_statement": "not_affected \u2014 Netty version 3.5.13.Final does not contain the HAProxy codec module. CVE-2022-41881 affects HAProxyMessageDecoder, which was introduced in Netty 4.x series. Version 3.5.13.Final uses the org.jboss.netty package namespace (Netty 3.x series) and includes only base64, compression, frame, HTTP, marshalling, protobuf, RTSP, serialization, SPDY, and string codecs. No HAProxy protocol support exists ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 3.5.13.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.5.13.Final is not affected by CVE-2023-34462. This vulnerability exists in Netty 4.x's SniHandler and SslClientHelloHandler classes, which manually parse TLS ClientHello messages to extract SNI (Server Name Indication) information. These classes read the handshake length field (3 bytes, max 16MB) and allocate ByteBuf based on it without validation, allowing attackers to force 16MB heap ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Netty 3.5.13.Final is not affected by CVE-2023-34462. This vulnerability exists in Netty 4.x's SniHandler and SslClientHelloHandler classes, which manually parse TLS ClientHello messages to extract SNI (Server Name Indication) information. These classes read the handshake length field (3 bytes, max 16MB) and allocate ByteBuf based on it without validation, allowing attackers to force 16MB heap ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2023-44487 does not affect version 3.5.13.Final-tuxcare.1 of io.netty:netty. Netty 3.5.13.Final does not implement HTTP/2, therefore CVE-2023-44487 (HTTP/2 Rapid Reset attack) does not apply. The target version predates HTTP/2 support, which was added in Netty 4.1.x series. While Netty 3.x includes SPDY support (HTTP/2's deprecated predecessor), SPDY and HTTP/2 are distinct protocols, and the CVE explicitly targets \"The HTTP/2 protocol\".", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-44487" }, "impact_statement": "Netty 3.5.13.Final does not implement HTTP/2, therefore CVE-2023-44487 (HTTP/2 Rapid Reset attack) does not apply. The target version predates HTTP/2 support, which was added in Netty 4.1.x series. While Netty 3.x includes SPDY support (HTTP/2's deprecated predecessor), SPDY and HTTP/2 are distinct protocols, and the CVE explicitly targets \"The HTTP/2 protocol\"." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2024-29025 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2024-29025" }, "action_statement": "Vulnerability CVE-2024-29025 affects version 3.5.13.Final-tuxcare.1 of io.netty:netty." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2024-47535 does not affect version 3.5.13.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.5.13.Final is not affected by CVE-2024-47535. The vulnerability concerns unbounded file reads during initialization in Netty 4.x (specifically reading /etc/os-release, /usr/lib/os-release, and /proc/sys/net/core/somaxconn). Exhaustive analysis confirms these file reads do not exist in Netty 3.x. The target uses a fundamentally different architecture (org.jboss.netty.* package namespace)...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-47535" }, "impact_statement": "not_affected \u2014 Netty 3.5.13.Final is not affected by CVE-2024-47535. The vulnerability concerns unbounded file reads during initialization in Netty 4.x (specifically reading /etc/os-release, /usr/lib/os-release, and /proc/sys/net/core/somaxconn). Exhaustive analysis confirms these file reads do not exist in Netty 3.x. The target uses a fundamentally different architecture (org.jboss.netty.* package namespace)..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2025-25193 does not affect version 3.5.13.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.5.13.Final is not affected by CVE-2025-25193. The vulnerable component (BoundedInputStream class) does not exist in Netty 3.x. BoundedInputStream was introduced in Netty 4.x as part of CVE-2024-47535 mitigation to protect system configuration file reads. Netty 3.5.13.Final lacks both the vulnerable class and the system file reading functionality it was designed to protect (NetUtil, Plat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-25193" }, "impact_statement": "not_affected \u2014 Netty 3.5.13.Final is not affected by CVE-2025-25193. The vulnerable component (BoundedInputStream class) does not exist in Netty 3.x. BoundedInputStream was introduced in Netty 4.x as part of CVE-2024-47535 mitigation to protect system configuration file reads. Netty 3.5.13.Final lacks both the vulnerable class and the system file reading functionality it was designed to protect (NetUtil, Plat..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2025-55163 does not affect version 3.5.13.Final-tuxcare.1 of io.netty:netty. Netty 3.5.13.Final is not affected by CVE-2025-55163 (MadeYouReset) because this version predates HTTP/2 support entirely. The vulnerability is specific to HTTP/2 protocol handling, which was only added in Netty 4.1.x (released ~2016). This version from 2013 only supports HTTP/1.x and SPDY protocols. The affected code path (io.netty.handler.codec.http2 package and HTTP/2 frame processing) does not exist in Netty 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-55163" }, "impact_statement": "Netty 3.5.13.Final is not affected by CVE-2025-55163 (MadeYouReset) because this version predates HTTP/2 support entirely. The vulnerability is specific to HTTP/2 protocol handling, which was only added in Netty 4.1.x (released ~2016). This version from 2013 only supports HTTP/1.x and SPDY protocols. The affected code path (io.netty.handler.codec.http2 package and HTTP/2 frame processing) does not exist in Netty 3.x." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2025-58057 is fixed in version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2025-58057" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.5.13.Final-tuxcare.1" } } ], "timestamp": "2026-10-22T16:13:24.840809+00:00", "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 3.5.13.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2025-67735" } } ] }