{
  "@id": "urn:uuid:a8a8666b-9f31-4756-9fae-d50bd38e3195",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:05:28.850476+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 does not affect this target. The upstream fix (commit b705091afb9158b39590fa36b9b84795524a8f0b by simone.bordet@gmail.com) was already present in the upstream Jetty release before TuxCare onboarded version 10.0.26. The target version 10.0.33 inherits this fix. The vulnerable code pattern (synchronous onBadMessage() calls that block selector threads) has been replaced with deferred execution via Runnable returns in both HttpChannelOverHTTP2.onRequest() and onPushRequest() methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 does not affect this target. The upstream fix (commit b705091afb9158b39590fa36b9b84795524a8f0b by simone.bordet@gmail.com) was already present in the upstream Jetty release before TuxCare onboarded version 10.0.26. The target version 10.0.33 inherits this fix. The vulnerable code pattern (synchronous onBadMessage() calls that block selector threads) has been replaced with deferred execution via Runnable returns in both HttpChannelOverHTTP2.onRequest() and onPushRequest() methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server. Target version 10.0.33 is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset). The fix (commit 0f246d12) was included in upstream Jetty 10.0.26, released Oct 2023. TuxCare onboarded from 10.0.26 in Dec 2025, inheriting the fix. Verified that rate controls for RST_STREAM, CONTINUATION, SETTINGS frames and header block size limits are present in the target code. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "Target version 10.0.33 is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset). The fix (commit 0f246d12) was included in upstream Jetty 10.0.26, released Oct 2023. TuxCare onboarded from 10.0.26 in Dec 2025, inheriting the fix. Verified that rate controls for RST_STREAM, CONTINUATION, SETTINGS frames and header block size limits are present in the target code. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T21:10:30.464414+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T21:10:30.464414+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T21:10:30.464414+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T22:44:40.243946+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T22:44:40.243946+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T22:44:40.243946+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    }
  ]
}