{
  "@id": "urn:uuid:414b61c1-9db6-4596-822c-5d3e26eba65e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty.http2:http2-server. The target Jetty 10.0.27.tuxcare0004 is NOT affected by CVE-2022-2048. The vulnerability fix was already present in the upstream Jetty 10.0.27 release before TuxCare's involvement. Both HTTP/2 and HTTP/3 error handling code properly defer onBadMessage() calls via Runnable wrappers, preventing selector thread blocking. The fix was authored by upstream Jetty developer Simone Bordet (commits b705091 and 513a2cb) and shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "The target Jetty 10.0.27.tuxcare0004 is NOT affected by CVE-2022-2048. The vulnerability fix was already present in the upstream Jetty 10.0.27 release before TuxCare's involvement. Both HTTP/2 and HTTP/3 error handling code properly defer onBadMessage() calls via Runnable wrappers, preventing selector thread blocking. The fix was authored by upstream Jetty developer Simone Bordet (commits b705091 and 513a2cb) and shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty.http2:http2-server. The target repository (Jetty 10.0.27) is NOT vulnerable to CVE-2023-44487 (HTTP/2 Rapid Reset attack). The vulnerability pattern is not present because the upstream fix was already included in Jetty 10.0.17 (released October 9, 2023), which predates the target version 10.0.27 (released January 27, 2026). The fix implements rate control for RST_STREAM, CONTINUATION, SETTINGS, and PUSH_PROMISE frames, plus header block buffer growth protection. TuxCare did not need to backport this CVE to 10.0.27 as it was already fixed upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (Jetty 10.0.27) is NOT vulnerable to CVE-2023-44487 (HTTP/2 Rapid Reset attack). The vulnerability pattern is not present because the upstream fix was already included in Jetty 10.0.17 (released October 9, 2023), which predates the target version 10.0.27 (released January 27, 2026). The fix implements rate control for RST_STREAM, CONTINUATION, SETTINGS, and PUSH_PROMISE frames, plus header block buffer growth protection. TuxCare did not need to backport this CVE to 10.0.27 as it was already fixed upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}