{
  "@id": "urn:uuid:72cdffd3-705c-4c6c-bd9d-4d4968d498c9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T13:45:52.646915+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.57.v20241219-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.57.v20241219-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T13:45:52.646915+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 9.4.57.v20241219-tuxcare.7 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 affects Jetty versions before 9.4.47, 10.0.10, and 11.0.10. The target repository is Jetty 9.4.57.v20241219, which already contains the upstream fix. The vulnerability involved synchronous error handling on the selector thread when processing invalid HTTP/2 requests, allowing malicious clients to block all selector threads and cause denial of service. The fix changes exception handlers in HttpChannelOverHTTP2.onRequest() and onPushRequest() to return error handling as a Runnable for deferred execution instead of calling onBadMessage() directly. This upstream fix (commit be912d43158 by joakim.erdfelt@gmail.com) was already present in the 9.4.57 release when TuxCare onboarded it (initial setup commit 7d86f2018ba by npinsker@cloudlinux.com). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 affects Jetty versions before 9.4.47, 10.0.10, and 11.0.10. The target repository is Jetty 9.4.57.v20241219, which already contains the upstream fix. The vulnerability involved synchronous error handling on the selector thread when processing invalid HTTP/2 requests, allowing malicious clients to block all selector threads and cause denial of service. The fix changes exception handlers in HttpChannelOverHTTP2.onRequest() and onPushRequest() to return error handling as a Runnable for deferred execution instead of calling onBadMessage() directly. This upstream fix (commit be912d43158 by joakim.erdfelt@gmail.com) was already present in the 9.4.57 release when TuxCare onboarded it (initial setup commit 7d86f2018ba by npinsker@cloudlinux.com). The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.57.v20241219-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.57.v20241219-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T13:45:52.646915+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.57.v20241219-tuxcare.7 of org.eclipse.jetty.http2:http2-server. Target is NOT AFFECTED. CVE-2023-44487 (HTTP/2 Rapid Reset) fix commit 0f246d12090 is already present in HEAD. The fix was authored by upstream Jetty developer Simone Bordet (simone.bordet@gmail.com) and shipped in upstream release 9.4.57.v20241219, 205 commits before TuxCare onboarded the project (first TuxCare commit 7d86f2018ba by npinsker@cloudlinux.com). All defenses are active by default: rate limiting (128 events/s) on RST_STREAM, CONTINUATION, SETTINGS, and invalid PUSH_PROMISE frames, plus capacity limits on header block accumulation to prevent unbounded memory growth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "Target is NOT AFFECTED. CVE-2023-44487 (HTTP/2 Rapid Reset) fix commit 0f246d12090 is already present in HEAD. The fix was authored by upstream Jetty developer Simone Bordet (simone.bordet@gmail.com) and shipped in upstream release 9.4.57.v20241219, 205 commits before TuxCare onboarded the project (first TuxCare commit 7d86f2018ba by npinsker@cloudlinux.com). All defenses are active by default: rate limiting (128 events/s) on RST_STREAM, CONTINUATION, SETTINGS, and invalid PUSH_PROMISE frames, plus capacity limits on header block accumulation to prevent unbounded memory growth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}