{
  "@id": "urn:uuid:9765fb68-c3c4-4c59-9145-516cddefdaa0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty.http2:http2-common. The target repository (Jetty 10.0.27) is NOT vulnerable to CVE-2023-44487 (HTTP/2 Rapid Reset attack). The vulnerability pattern is not present because the upstream fix was already included in Jetty 10.0.17 (released October 9, 2023), which predates the target version 10.0.27 (released January 27, 2026). The fix implements rate control for RST_STREAM, CONTINUATION, SETTINGS, and PUSH_PROMISE frames, plus header block buffer growth protection. TuxCare did not need to backport this CVE to 10.0.27 as it was already fixed upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (Jetty 10.0.27) is NOT vulnerable to CVE-2023-44487 (HTTP/2 Rapid Reset attack). The vulnerability pattern is not present because the upstream fix was already included in Jetty 10.0.17 (released October 9, 2023), which predates the target version 10.0.27 (released January 27, 2026). The fix implements rate control for RST_STREAM, CONTINUATION, SETTINGS, and PUSH_PROMISE frames, plus header block buffer growth protection. TuxCare did not need to backport this CVE to 10.0.27 as it was already fixed upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty.http2:http2-common. Version 10.0.27 is not vulnerable. Summary: CVE-2024-22201 is NOT present in the target repository. The fix for issue #11259 (HTTP/2 connection not closed after idle timeout when TCP congested) has been properly applied to both HTTP/2 and HTTP/3 components. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "impact_statement": "Version 10.0.27 is not vulnerable. Summary: CVE-2024-22201 is NOT present in the target repository. The fix for issue #11259 (HTTP/2 connection not closed after idle timeout when TCP congested) has been properly applied to both HTTP/2 and HTTP/3 components. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty.http2:http2-common. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-5115"
      },
      "impact_statement": "fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable"
    }
  ]
}