{
  "@id": "urn:uuid:69e96941-bb47-4461-a3c9-ec5b93636fe9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 is not present in this target repository. The vulnerability involved HTTP/2 and HTTP/3 error handlers calling onBadMessage() synchronously on selector threads, causing denial of service when flow control exhaustion or TCP congestion blocks error response writes. The upstream fix (commits be912d4315839405a8ae601f2e4ee0306867266e and 513a2cb2562ff5745b3a7e1e538a4b53759ce7ec by Joakim Erdfelt and Simone Bordet) wraps error handling in Runnables to defer execution off selector threads. Both fixes were already present in Jetty 11.0.26, which TuxCare onboarded as the base for version 11.0.31. The vulnerable pattern (direct onBadMessage calls in exception handlers) is absent from HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 is not present in this target repository. The vulnerability involved HTTP/2 and HTTP/3 error handlers calling onBadMessage() synchronously on selector threads, causing denial of service when flow control exhaustion or TCP congestion blocks error response writes. The upstream fix (commits be912d4315839405a8ae601f2e4ee0306867266e and 513a2cb2562ff5745b3a7e1e538a4b53759ce7ec by Joakim Erdfelt and Simone Bordet) wraps error handling in Runnables to defer execution off selector threads. Both fixes were already present in Jetty 11.0.26, which TuxCare onboarded as the base for version 11.0.31. The vulnerable pattern (direct onBadMessage calls in exception handlers) is absent from HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-server. The target repository (Jetty 11.0.31.tuxcare0001) is NOT vulnerable to CVE-2023-44487 (HTTP/2 Rapid Reset attack). The fix for this vulnerability was already present in the upstream Jetty release 11.0.26, which was onboarded by TuxCare in December 2025. The vulnerable code pattern (lack of RST_STREAM frame rate limiting) does not exist in the target because the upstream fix commit 0f246d12090 (authored by Simone Bordet on Oct 9, 2023) added rate control to RST_STREAM frames and was included in all Jetty 11.0.x releases from 11.0.26 onwards. The target version 11.0.31 inherits this protection from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (Jetty 11.0.31.tuxcare0001) is NOT vulnerable to CVE-2023-44487 (HTTP/2 Rapid Reset attack). The fix for this vulnerability was already present in the upstream Jetty release 11.0.26, which was onboarded by TuxCare in December 2025. The vulnerable code pattern (lack of RST_STREAM frame rate limiting) does not exist in the target because the upstream fix commit 0f246d12090 (authored by Simone Bordet on Oct 9, 2023) added rate control to RST_STREAM frames and was included in all Jetty 11.0.x releases from 11.0.26 onwards. The target version 11.0.31 inherits this protection from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}