{
  "@id": "urn:uuid:8552a26b-fbea-4009-8995-3e7edc63ccb7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 11.0.27.tuxcare0004 of org.eclipse.jetty.http2:http2-common. The target repository (Jetty 11.0.27) is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The upstream fix commit 0f246d12090 by Simone Bordet was shipped in Jetty 11.0.26 (October 2023) and is present in the target version. All defense mechanisms are verified in the source code: rate limiting for RST_STREAM, SETTINGS, and CONTINUATION frames using sliding window counters (128 events/s threshold), and max capacity checks for header block buffer growth. The vulnerable code patterns allowing unbounded rapid resets are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (Jetty 11.0.27) is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The upstream fix commit 0f246d12090 by Simone Bordet was shipped in Jetty 11.0.26 (October 2023) and is present in the target version. All defense mechanisms are verified in the source code: rate limiting for RST_STREAM, SETTINGS, and CONTINUATION frames using sliding window counters (128 events/s threshold), and max capacity checks for header block buffer growth. The vulnerable code patterns allowing unbounded rapid resets are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 does not affect version 11.0.27.tuxcare0004 of org.eclipse.jetty.http2:http2-common. Jetty 11.0.27 is not affected by CVE-2024-22201 according to the advisories",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "impact_statement": "Jetty 11.0.27 is not affected by CVE-2024-22201 according to the advisories"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 does not affect version 11.0.27.tuxcare0004 of org.eclipse.jetty.http2:http2-common. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-5115"
      },
      "impact_statement": "fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable"
    }
  ]
}