{
  "@id": "urn:uuid:c5d048dc-51d3-45e2-a8b4-b2375a50d35d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 is not present in Jetty 10.0.31. The vulnerability involved HTTP/2 error handling that could block selector threads when invalid requests exhausted flow control. The upstream fix (commit be912d4315839405a8ae601f2e4ee0306867266e) changed exception handlers to return error handling as a Runnable for deferred execution instead of calling onBadMessage() synchronously. This fix was already present in Jetty 10.0.10 (released May 2022) and was included in the upstream release that TuxCare onboarded as version 10.0.26, well before the current 10.0.31.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 is not present in Jetty 10.0.31. The vulnerability involved HTTP/2 error handling that could block selector threads when invalid requests exhausted flow control. The upstream fix (commit be912d4315839405a8ae601f2e4ee0306867266e) changed exception handlers to return error handling as a Runnable for deferred execution instead of calling onBadMessage() synchronously. This fix was already present in Jetty 10.0.10 (released May 2022) and was included in the upstream release that TuxCare onboarded as version 10.0.26, well before the current 10.0.31.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-server. The target repository (Jetty 10.0.31.tuxcare0001) is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The vulnerability has been mitigated by upstream fixes that were already present in the upstream release TuxCare onboarded. The defense mechanism (rate limiting of HTTP/2 control frames via WindowRateControl at 128 events/second) is fully implemented and active in the target codebase. The fix was authored by upstream Jetty developer Simone Bordet (simone.bordet@gmail.com) in commit dbb94514dc9, which first appeared in Jetty 10.0.17 and predates all TuxCare work on this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (Jetty 10.0.31.tuxcare0001) is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The vulnerability has been mitigated by upstream fixes that were already present in the upstream release TuxCare onboarded. The defense mechanism (rate limiting of HTTP/2 control frames via WindowRateControl at 128 events/second) is fully implemented and active in the target codebase. The fix was authored by upstream Jetty developer Simone Bordet (simone.bordet@gmail.com) in commit dbb94514dc9, which first appeared in Jetty 10.0.17 and predates all TuxCare work on this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}