{
  "@id": "urn:uuid:f0d1de1a-c744-4a98-9829-3dd99b2423de",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 20,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@11.0.19-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@11.0.19-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2023-36478 does not affect version 11.0.19-tuxcare.1 of org.eclipse.jetty.http2:http2-hpack. CVE-2023-36478 is NOT present in target Jetty 11.0.19. The vulnerable integer overflow pattern in HPACK header processing was fixed in upstream Jetty before the 11.0.19 release. The fix refactored the code to use Math.multiplyExact/addExact for overflow detection in NBitIntegerDecoder and removed the vulnerable checkSize method that performed unsafe `(length * 4) / 3` calculation. The fix was already present when TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53), NVD (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16), cve.org (>= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53), Snyk (>= 9.3.0, < 9.4.53.v20231009; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53.v20231009; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-36478"
      },
      "impact_statement": "CVE-2023-36478 is NOT present in target Jetty 11.0.19. The vulnerable integer overflow pattern in HPACK header processing was fixed in upstream Jetty before the 11.0.19 release. The fix refactored the code to use Math.multiplyExact/addExact for overflow detection in NBitIntegerDecoder and removed the vulnerable checkSize method that performed unsafe `(length * 4) / 3` calculation. The fix was already present when TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53), NVD (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16), cve.org (>= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53), Snyk (>= 9.3.0, < 9.4.53.v20231009; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53.v20231009; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16)."
    }
  ]
}