{
  "@id": "urn:uuid:233902c5-6449-44af-b32d-7f077f157b57",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T15:49:32.960958+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.59.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.59.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-09T15:49:32.960958+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.59.tuxcare0004 of org.eclipse.jetty.http2:http2-common. CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT affecting this target. The vulnerability requires rate limiting on HTTP/2 control frames (RST_STREAM, CONTINUATION, SETTINGS) and bounds on header block accumulation to prevent resource exhaustion. All required protections were implemented in upstream Jetty 9.4.53.v20231009 (commit 0f246d12090 by Simone Bordet, October 2023). The target version 9.4.59.tuxcare0003 includes this upstream fix, which was already present in the release that TuxCare onboarded. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT affecting this target. The vulnerability requires rate limiting on HTTP/2 control frames (RST_STREAM, CONTINUATION, SETTINGS) and bounds on header block accumulation to prevent resource exhaustion. All required protections were implemented in upstream Jetty 9.4.53.v20231009 (commit 0f246d12090 by Simone Bordet, October 2023). The target version 9.4.59.tuxcare0003 includes this upstream fix, which was already present in the release that TuxCare onboarded. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.59.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.59.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-09T15:49:32.960958+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 does not affect version 9.4.59.tuxcare0004 of org.eclipse.jetty.http2:http2-common. Version 9.4.59 is not vulnerable. Summary: The target repository (Jetty version 9.4.59.tuxcare00001) already contains the fix for CVE-2024-22201. The HTTP/2 idle timeout connection leak vulnerability has been patched. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "impact_statement": "Version 9.4.59 is not vulnerable. Summary: The target repository (Jetty version 9.4.59.tuxcare00001) already contains the fix for CVE-2024-22201. The HTTP/2 idle timeout connection leak vulnerability has been patched. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.59.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.59.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-09T15:49:32.960958+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 is fixed in version 9.4.59.tuxcare0004 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2025-5115"
      }
    }
  ]
}