{
  "@id": "urn:uuid:9528174e-1219-4040-93d1-1f6491b1dec4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-common. The target repository (Jetty 10.0.31.tuxcare0001) is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The vulnerability has been mitigated by upstream fixes that were already present in the upstream release TuxCare onboarded. The defense mechanism (rate limiting of HTTP/2 control frames via WindowRateControl at 128 events/second) is fully implemented and active in the target codebase. The fix was authored by upstream Jetty developer Simone Bordet (simone.bordet@gmail.com) in commit dbb94514dc9, which first appeared in Jetty 10.0.17 and predates all TuxCare work on this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (Jetty 10.0.31.tuxcare0001) is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The vulnerability has been mitigated by upstream fixes that were already present in the upstream release TuxCare onboarded. The defense mechanism (rate limiting of HTTP/2 control frames via WindowRateControl at 128 events/second) is fully implemented and active in the target codebase. The fix was authored by upstream Jetty developer Simone Bordet (simone.bordet@gmail.com) in commit dbb94514dc9, which first appeared in Jetty 10.0.17 and predates all TuxCare work on this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-common. CVE-2024-22201 is not present in target Jetty 10.0.31. The vulnerability (HTTP/2 idle timeout failure to close TCP-congested connections) was fixed by upstream vendor in commit b953871c9a5ff4fbca4a2499848f75182dbd9810, included in Jetty 10.0.20 release (January 2024). Target version 10.0.31 contains this fix. The vulnerable code pattern (early return without calling terminate()) has been replaced with logic that force-terminates the connection even when the session is marked closed, preventing file descriptor exhaustion.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "impact_statement": "CVE-2024-22201 is not present in target Jetty 10.0.31. The vulnerability (HTTP/2 idle timeout failure to close TCP-congested connections) was fixed by upstream vendor in commit b953871c9a5ff4fbca4a2499848f75182dbd9810, included in Jetty 10.0.20 release (January 2024). Target version 10.0.31 contains this fix. The vulnerable code pattern (early return without calling terminate()) has been replaced with logic that force-terminates the connection even when the session is marked closed, preventing file descriptor exhaustion."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-common. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-5115"
      },
      "impact_statement": "fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable"
    }
  ]
}