{
  "@id": "urn:uuid:28292357-c6f9-4aef-a21a-046d5d5f1149",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 is not present in Jetty 11.0.32. The vulnerability involved invalid HTTP/2 requests causing blocking error responses to be written directly from selector threads, leading to denial of service when all selector threads become blocked. The upstream fix (commit b705091afb9) was shipped in Jetty version 11.0.10, changing error handling to return Runnables instead of calling onBadMessage() directly. Since the target is version 11.0.32 (released after 11.0.10), it inherits the upstream fix. Both HTTP/2 and HTTP/3 code paths correctly wrap all onBadMessage() calls in lambda expressions, preventing selector thread blocking.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 is not present in Jetty 11.0.32. The vulnerability involved invalid HTTP/2 requests causing blocking error responses to be written directly from selector threads, leading to denial of service when all selector threads become blocked. The upstream fix (commit b705091afb9) was shipped in Jetty version 11.0.10, changing error handling to return Runnables instead of calling onBadMessage() directly. Since the target is version 11.0.32 (released after 11.0.10), it inherits the upstream fix. Both HTTP/2 and HTTP/3 code paths correctly wrap all onBadMessage() calls in lambda expressions, preventing selector thread blocking.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty.http2:http2-server. The target repository (Eclipse Jetty 11.0.32) is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The upstream fix commit 0f246d12090 by Simone Bordet, which adds rate control to RST_STREAM, CONTINUATION, and SETTINGS frame parsers, was already present in the upstream Jetty release that TuxCare onboarded. The vulnerable pattern (unbounded HTTP/2 control frame processing) does not exist in this version because the fix shipped in the upstream release before any TuxCare modifications were applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (Eclipse Jetty 11.0.32) is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The upstream fix commit 0f246d12090 by Simone Bordet, which adds rate control to RST_STREAM, CONTINUATION, and SETTINGS frame parsers, was already present in the upstream Jetty release that TuxCare onboarded. The vulnerable pattern (unbounded HTTP/2 control frame processing) does not exist in this version because the fix shipped in the upstream release before any TuxCare modifications were applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 11.0.32.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 11.0.32.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 11.0.32.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    }
  ]
}