{
  "@id": "urn:uuid:8fd88eee-0a28-4522-a42a-d1bbf67d25c1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 10.0.30.tuxcare0001 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 does not affect this target. The vulnerable pattern (direct onBadMessage() calls from selector threads blocking on error responses) is not present. The fix was already included in the upstream Jetty 10.0.x release before TuxCare's work on version 10.0.30. Upstream commit b705091afb9 by Simone Bordet changed HTTP/2 error handling to return Runnables instead of calling onBadMessage() directly, preventing selector thread blocking. This fix is present in the target at HttpChannelOverHTTP2.java lines 157-166 and 189-196.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 does not affect this target. The vulnerable pattern (direct onBadMessage() calls from selector threads blocking on error responses) is not present. The fix was already included in the upstream Jetty 10.0.x release before TuxCare's work on version 10.0.30. Upstream commit b705091afb9 by Simone Bordet changed HTTP/2 error handling to return Runnables instead of calling onBadMessage() directly, preventing selector thread blocking. This fix is present in the target at HttpChannelOverHTTP2.java lines 157-166 and 189-196.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.0.30.tuxcare0001 of org.eclipse.jetty.http2:http2-server. The target repository (Jetty 10.0.30.tuxcare0002) is NOT affected by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The upstream fix commit 0f246d12090fb15b7b21dee8429f459fd792de53 authored by simone.bordet@gmail.com was already included in the upstream release that TuxCare onboarded. All required rate control mechanisms are present and enabled by default: RST_STREAM frame rate limiting (ResetBodyParser.java:91-92), CONTINUATION frame rate limiting (ContinuationBodyParser.java:48-49,79-80,92-93), SETTINGS frame rate limiting (SettingsBodyParser.java:223), header block accumulation limits (HeaderBlockFragments.java:59-60,69-70), and the default rate is set to 128 events/second (AbstractHTTP2ServerConnectionFactory.java:66). This is an upstream fix that shipped in jetty-9.4.52.v20230823 and was inherited by the 10.0.x line before TuxCare's first commit (b53758d414f \"setup 10.0.26\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (Jetty 10.0.30.tuxcare0002) is NOT affected by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The upstream fix commit 0f246d12090fb15b7b21dee8429f459fd792de53 authored by simone.bordet@gmail.com was already included in the upstream release that TuxCare onboarded. All required rate control mechanisms are present and enabled by default: RST_STREAM frame rate limiting (ResetBodyParser.java:91-92), CONTINUATION frame rate limiting (ContinuationBodyParser.java:48-49,79-80,92-93), SETTINGS frame rate limiting (SettingsBodyParser.java:223), header block accumulation limits (HeaderBlockFragments.java:59-60,69-70), and the default rate is set to 128 events/second (AbstractHTTP2ServerConnectionFactory.java:66). This is an upstream fix that shipped in jetty-9.4.52.v20230823 and was inherited by the 10.0.x line before TuxCare's first commit (b53758d414f \"setup 10.0.26\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}