{
  "@id": "urn:uuid:391d84bd-3d43-4896-bd38-3d129f8a38fb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.29.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.29.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 11.0.29.tuxcare0001 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 is NOT present in target Jetty 11.0.29. The vulnerability was fixed in upstream Jetty 11.0.10 (commit b705091afb9 by Simone Bordet, May 2022). The fix changes HTTP/2 and HTTP/3 error handlers to return error-handling code as a Runnable instead of executing onBadMessage() synchronously from the selector thread, preventing selector thread blocking. This fix was already present in the upstream release when TuxCare onboarded version 11.0.26, making it an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 is NOT present in target Jetty 11.0.29. The vulnerability was fixed in upstream Jetty 11.0.10 (commit b705091afb9 by Simone Bordet, May 2022). The fix changes HTTP/2 and HTTP/3 error handlers to return error-handling code as a Runnable instead of executing onBadMessage() synchronously from the selector thread, preventing selector thread blocking. This fix was already present in the upstream release when TuxCare onboarded version 11.0.26, making it an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.29.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.29.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 11.0.29.tuxcare0001 of org.eclipse.jetty.http2:http2-server. CVE-2023-44487 (HTTP/2 Rapid Reset) is not present in jetty-project 11.0.29.tuxcare0004. The complete rate control fix for RST_STREAM, CONTINUATION, and SETTINGS frames was already included in upstream Jetty 11.0.26, which TuxCare onboarded. The defense is active by default with WindowRateControl limiting frames to 128 events/second.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset) is not present in jetty-project 11.0.29.tuxcare0004. The complete rate control fix for RST_STREAM, CONTINUATION, and SETTINGS frames was already included in upstream Jetty 11.0.26, which TuxCare onboarded. The defense is active by default with WindowRateControl limiting frames to 128 events/second.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}