{
  "@id": "urn:uuid:5b55544d-c718-4131-a53c-ae6cc9a40015",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 20,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.50.v20221201-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.50.v20221201-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 is not present in the target. The vulnerability was fixed in upstream Jetty commit be912d43158 (authored by joakim.erdfelt@gmail.com) which shipped in upstream release 9.4.50.v20221201, before TuxCare onboarded this version. The fix changes error handling in HttpChannelOverHTTP2.java to return error processing as a Runnable (deferred execution) instead of calling onBadMessage() directly on the selector thread, preventing blocking writes that could exhaust selector threads and cause DoS. The fix is present at HttpChannelOverHTTP2.java lines 148, 152, 178, and 182.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 is not present in the target. The vulnerability was fixed in upstream Jetty commit be912d43158 (authored by joakim.erdfelt@gmail.com) which shipped in upstream release 9.4.50.v20221201, before TuxCare onboarded this version. The fix changes error handling in HttpChannelOverHTTP2.java to return error processing as a Runnable (deferred execution) instead of calling onBadMessage() directly on the selector thread, preventing blocking writes that could exhaust selector threads and cause DoS. The fix is present at HttpChannelOverHTTP2.java lines 148, 152, 178, and 182.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.50.v20221201-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.50.v20221201-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      }
    }
  ]
}