{
  "@id": "urn:uuid:0ad397fc-2a64-4197-9cfa-249956aff6e0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty.http2:http2-server. The target (Jetty 9.4.60.tuxcare0003) is not affected by CVE-2022-2048. The vulnerability involved invalid HTTP/2 requests causing blocking error responses written directly from selector threads, leading to denial of service when clients exhaust flow control or TCP congest the connection. The fix (returning error handling as a Runnable for deferred execution instead of blocking the selector thread) was already present in the upstream Jetty 9.4.60 release (commit be912d43158 from May 2022) that TuxCare onboarded. The current code properly returns lambda expressions `() -> onBadMessage(x)` instead of calling `onBadMessage(x)` directly on the selector thread in both onRequest() and onPushRequest() methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "The target (Jetty 9.4.60.tuxcare0003) is not affected by CVE-2022-2048. The vulnerability involved invalid HTTP/2 requests causing blocking error responses written directly from selector threads, leading to denial of service when clients exhaust flow control or TCP congest the connection. The fix (returning error handling as a Runnable for deferred execution instead of blocking the selector thread) was already present in the upstream Jetty 9.4.60 release (commit be912d43158 from May 2022) that TuxCare onboarded. The current code properly returns lambda expressions `() -> onBadMessage(x)` instead of calling `onBadMessage(x)` directly on the selector thread in both onRequest() and onPushRequest() methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty.http2:http2-server. CVE-2023-44487 (HTTP/2 Rapid Reset) is not present in jetty.project 9.4.60. The upstream vendor fix (commit 0f246d12090 by Simone Bordet, \"Fixes #10679 - Review HTTP/2 rate control\") was already included in Jetty 9.4.53.v20231009, which predates the TuxCare onboarding of version 9.4.58.1. The fix adds rate limiting (128 events/s) on RST_STREAM, CONTINUATION, and SETTINGS frames, plus bounds checking on header block fragment accumulation. All defensive mechanisms are present and enabled by default in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset) is not present in jetty.project 9.4.60. The upstream vendor fix (commit 0f246d12090 by Simone Bordet, \"Fixes #10679 - Review HTTP/2 rate control\") was already included in Jetty 9.4.53.v20231009, which predates the TuxCare onboarding of version 9.4.58.1. The fix adds rate limiting (128 events/s) on RST_STREAM, CONTINUATION, and SETTINGS frames, plus bounds checking on header block fragment accumulation. All defensive mechanisms are present and enabled by default in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}