{ "@id": "urn:uuid:9ff95e40-58fc-442b-bb01-859e2411d739", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-14T05:59:00.118035+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2014-0193 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2014-0193" }, "action_statement": "Vulnerability CVE-2014-0193 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2014-3488 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2014-3488" }, "action_statement": "Vulnerability CVE-2014-3488 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2015-2156 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2015-2156" }, "action_statement": "Vulnerability CVE-2015-2156 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2019-16869 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2019-16869" }, "action_statement": "Vulnerability CVE-2019-16869 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2019-20444 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2019-20444" }, "action_statement": "Vulnerability CVE-2019-20444 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2019-20445 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2019-20445" }, "action_statement": "Vulnerability CVE-2019-20445 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2020-11612 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2020-11612" }, "action_statement": "Vulnerability CVE-2020-11612 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:59:00.118035+00:00", "status_notes": "Vulnerability CVE-2021-21290 is fixed in version 3.7.0.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2021-21290" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2021-21295 does not affect version 3.7.0.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2021-21295. This vulnerability concerns HTTP/2 Content-Length validation in Netty 4.x's HTTP/2 codec. Netty 3.x (package org.jboss.netty) has no HTTP/2 support - it only supports HTTP/1.0 and HTTP/1.1. The vulnerable component (HTTP/2 codec) was introduced in Netty 4.x and does not exist in Netty 3.x at all.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21295" }, "impact_statement": "not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2021-21295. This vulnerability concerns HTTP/2 Content-Length validation in Netty 4.x's HTTP/2 codec. Netty 3.x (package org.jboss.netty) has no HTTP/2 support - it only supports HTTP/1.0 and HTTP/1.1. The vulnerable component (HTTP/2 codec) was introduced in Netty 4.x and does not exist in Netty 3.x at all." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2021-21409 does not affect version 3.7.0.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2021-21409. This CVE concerns improper HTTP/2 content-length validation in Netty 4.x's codec-http2 module. Netty 3.7.0.Final predates HTTP/2 support entirely - it uses the legacy org.jboss.netty.* package namespace and only supports HTTP/1.x, SPDY, and other pre-HTTP/2 protocols. The vulnerable code (DefaultHttp2ConnectionDecoder) and HTTP/2 frame types ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-21409" }, "impact_statement": "not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2021-21409. This CVE concerns improper HTTP/2 content-length validation in Netty 4.x's codec-http2 module. Netty 3.7.0.Final predates HTTP/2 support entirely - it uses the legacy org.jboss.netty.* package namespace and only supports HTTP/1.x, SPDY, and other pre-HTTP/2 protocols. The vulnerable code (DefaultHttp2ConnectionDecoder) and HTTP/2 frame types ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2021-37136 does not affect version 3.7.0.Final-tuxcare.1 of io.netty:netty. Target version netty-3.7.0.Final (package org.jboss.netty) does not contain the Bzip2Decoder component affected by CVE-2021-37136. The Bzip2 compression codec was introduced in Netty 4.x (package io.netty) and never existed in the Netty 3.x codebase. The target only implements Zlib-based compression; a TODO comment in package-info.java (line 28) confirms Bzip2 was planned but never implemented in this version. All CVE-2021-37136 backports in the repository history apply exclusively to 4.1.x versions (4.1.43, 4.1.48, 4.1.52, 4.1.58, 4.1.60, 4.1.63). Exhaustive searches found zero Bzip2 references, no vendored Bzip2 libraries, and no dependencies providing Bzip2 decompression. Verdict: NOT_AFFECTED per Rule 5 Type A1 (input type not received anywhere in codebase).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-37136" }, "impact_statement": "Target version netty-3.7.0.Final (package org.jboss.netty) does not contain the Bzip2Decoder component affected by CVE-2021-37136. The Bzip2 compression codec was introduced in Netty 4.x (package io.netty) and never existed in the Netty 3.x codebase. The target only implements Zlib-based compression; a TODO comment in package-info.java (line 28) confirms Bzip2 was planned but never implemented in this version. All CVE-2021-37136 backports in the repository history apply exclusively to 4.1.x versions (4.1.43, 4.1.48, 4.1.52, 4.1.58, 4.1.60, 4.1.63). Exhaustive searches found zero Bzip2 references, no vendored Bzip2 libraries, and no dependencies providing Bzip2 decompression. Verdict: NOT_AFFECTED per Rule 5 Type A1 (input type not received anywhere in codebase)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2021-37137 does not affect version 3.7.0.Final-tuxcare.1 of io.netty:netty. Netty 3.7.0.Final is not affected by CVE-2021-37137. The vulnerability concerns SnappyFrameDecoder, which was introduced in Netty 4.0.0.Beta1 and never existed in the 3.x lineage. Version 3.7.0.Final (released Sept 2013) predates the Netty 4.x rewrite where Snappy compression support was added (Dec 2012, first released in 4.0.0.Beta1). The target has no code that receives or processes Snappy-framed data.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-37137" }, "impact_statement": "Netty 3.7.0.Final is not affected by CVE-2021-37137. The vulnerability concerns SnappyFrameDecoder, which was introduced in Netty 4.0.0.Beta1 and never existed in the 3.x lineage. Version 3.7.0.Final (released Sept 2013) predates the Netty 4.x rewrite where Snappy compression support was added (Dec 2012, first released in 4.0.0.Beta1). The target has no code that receives or processes Snappy-framed data." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2021-43797 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2021-43797" }, "action_statement": "Vulnerability CVE-2021-43797 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2022-24823 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2022-24823" }, "action_statement": "Vulnerability CVE-2022-24823 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2022-41881 does not affect version 3.7.0.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2022-41881. The vulnerable component (HAProxyMessageDecoder in codec-haproxy module) does not exist in this version. HAProxy protocol support was added to Netty 4.x on 2014-04-22, approximately 7.5 months after Netty 3.7.0.Final was released on 2013-09-05. This version uses the org.jboss.netty.* package structure (Netty 3.x), whereas HAProxy codec exists...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-41881" }, "impact_statement": "not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2022-41881. The vulnerable component (HAProxyMessageDecoder in codec-haproxy module) does not exist in this version. HAProxy protocol support was added to Netty 4.x on 2014-04-22, approximately 7.5 months after Netty 3.7.0.Final was released on 2013-09-05. This version uses the org.jboss.netty.* package structure (Netty 3.x), whereas HAProxy codec exists..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2023-34462 does not affect version 3.7.0.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2023-34462. The vulnerable SniHandler and SslClientHelloHandler classes that parse ClientHello messages for SNI extraction were introduced in Netty 4.x (io.netty.*) and do not exist in Netty 3.x (org.jboss.netty.*). Netty 3.7.0.Final only contains a basic SslHandler that delegates to Java's SSLEngine without parsing TLS handshake messages. All TuxCare ba...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34462" }, "impact_statement": "not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2023-34462. The vulnerable SniHandler and SslClientHelloHandler classes that parse ClientHello messages for SNI extraction were introduced in Netty 4.x (io.netty.*) and do not exist in Netty 3.x (org.jboss.netty.*). Netty 3.7.0.Final only contains a basic SslHandler that delegates to Java's SSLEngine without parsing TLS handshake messages. All TuxCare ba..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2023-44487 does not affect version 3.7.0.Final-tuxcare.1 of io.netty:netty. Netty 3.7.0.Final does not contain any HTTP/2 codec implementation. CVE-2023-44487 (Rapid Reset) exploits HTTP/2 RST_STREAM frame flooding to cause denial of service. The target version predates HTTP/2 support in Netty (added in 4.x series with io.netty.handler.codec.http2 package). The target uses org.jboss.netty namespace (Netty 3.x) and supports only HTTP/1.x and SPDY protocols. Since HTTP/2 RST_STREAM frames (the CVE's specified Input) cannot be received by this version, the vulnerability does not apply.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-44487" }, "impact_statement": "Netty 3.7.0.Final does not contain any HTTP/2 codec implementation. CVE-2023-44487 (Rapid Reset) exploits HTTP/2 RST_STREAM frame flooding to cause denial of service. The target version predates HTTP/2 support in Netty (added in 4.x series with io.netty.handler.codec.http2 package). The target uses org.jboss.netty namespace (Netty 3.x) and supports only HTTP/1.x and SPDY protocols. Since HTTP/2 RST_STREAM frames (the CVE's specified Input) cannot be received by this version, the vulnerability does not apply." }, { "status": "affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2024-29025 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2024-29025" }, "action_statement": "Vulnerability CVE-2024-29025 affects version 3.7.0.Final-tuxcare.1 of io.netty:netty." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2024-47535 does not affect version 3.7.0.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2024-47535. The vulnerability exists in Netty 4.x code (io.netty package) that reads system configuration files during initialization without size limits. Netty 3.7.0 uses a fundamentally different architecture (org.jboss.netty package) and does not contain the vulnerable code pattern - no PlatformDependent class reading os-release files, no NetUtil read...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-47535" }, "impact_statement": "not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2024-47535. The vulnerability exists in Netty 4.x code (io.netty package) that reads system configuration files during initialization without size limits. Netty 3.7.0 uses a fundamentally different architecture (org.jboss.netty package) and does not contain the vulnerable code pattern - no PlatformDependent class reading os-release files, no NetUtil read..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2025-25193 does not affect version 3.7.0.Final-tuxcare.1 of io.netty:netty. not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2025-25193. The vulnerable component (BoundedInputStream class) and the file-reading-during-initialization code path where the null-byte counting bug manifests do not exist in this version. The vulnerability is specific to Netty 4.x architecture, which introduced BoundedInputStream in November 2024 to protect reading of /etc/os-release and similar system...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-25193" }, "impact_statement": "not_affected \u2014 Netty 3.7.0.Final is not affected by CVE-2025-25193. The vulnerable component (BoundedInputStream class) and the file-reading-during-initialization code path where the null-byte counting bug manifests do not exist in this version. The vulnerability is specific to Netty 4.x architecture, which introduced BoundedInputStream in November 2024 to protect reading of /etc/os-release and similar system..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:57:00.163220+00:00", "status_notes": "Vulnerability CVE-2025-55163 does not affect version 3.7.0.Final-tuxcare.1 of io.netty:netty. Netty 3.7.0.Final is not affected by CVE-2025-55163 (MadeYouReset HTTP/2 DDoS vulnerability). The target repository is Netty 3.x (package: org.jboss.netty), which only supports HTTP/1.0, HTTP/1.1, SPDY, and other legacy protocols. HTTP/2 protocol support was introduced in Netty 4.x (package: io.netty.handler.codec.http2). Exhaustive search confirmed zero HTTP/2 codec files, zero HTTP/2 frame handlers, and zero references to RFC 9113/7540 or HTTP/2 protocol. The CVE is explicitly scoped to the HTTP/2 protocol (RFC 9113), and all vendor patches modify only the Netty 4.x HTTP/2 codec. The INPUT type from the locked Attack Vector Brief (HTTP/2 control frames) cannot be received by Netty 3.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-55163" }, "impact_statement": "Netty 3.7.0.Final is not affected by CVE-2025-55163 (MadeYouReset HTTP/2 DDoS vulnerability). The target repository is Netty 3.x (package: org.jboss.netty), which only supports HTTP/1.0, HTTP/1.1, SPDY, and other legacy protocols. HTTP/2 protocol support was introduced in Netty 4.x (package: io.netty.handler.codec.http2). Exhaustive search confirmed zero HTTP/2 codec files, zero HTTP/2 frame handlers, and zero references to RFC 9113/7540 or HTTP/2 protocol. The CVE is explicitly scoped to the HTTP/2 protocol (RFC 9113), and all vendor patches modify only the Netty 4.x HTTP/2 codec. The INPUT type from the locked Attack Vector Brief (HTTP/2 control frames) cannot be received by Netty 3.x." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:59:00.118035+00:00", "status_notes": "Vulnerability CVE-2025-58056 is fixed in version 3.7.0.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2025-58056" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:59:00.118035+00:00", "status_notes": "Vulnerability CVE-2025-58057 is fixed in version 3.7.0.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2025-58057" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1", "identifiers": { "purl": "pkg:maven/io.netty/netty@3.7.0.Final-tuxcare.1" } } ], "timestamp": "2026-10-14T05:59:00.118035+00:00", "status_notes": "Vulnerability CVE-2025-67735 is fixed in version 3.7.0.Final-tuxcare.1 of io.netty:netty.", "vulnerability": { "name": "CVE-2025-67735" } } ] }