{
  "@id": "urn:uuid:0b95cfc8-2296-4cbc-88dc-5a4a23e7e829",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T15:11:05.515662+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.62.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.62.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-09T15:11:05.515662+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 9.4.62.tuxcare0003 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 is NOT present in the target. The vulnerability involved HTTP/2 error handlers calling onBadMessage() synchronously from selector threads, blocking them when clients exhaust flow control windows (DoS). The upstream fix (commit be912d43158) changed error handling to return Runnable lambdas for deferred execution. This fix was already present in upstream Jetty 9.4.47+ and was included in version 9.4.58.1 that TuxCare onboarded. Target version 9.4.62 contains the complete fix. The vulnerable pattern (direct onBadMessage() calls returning null) is absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 is NOT present in the target. The vulnerability involved HTTP/2 error handlers calling onBadMessage() synchronously from selector threads, blocking them when clients exhaust flow control windows (DoS). The upstream fix (commit be912d43158) changed error handling to return Runnable lambdas for deferred execution. This fix was already present in upstream Jetty 9.4.47+ and was included in version 9.4.58.1 that TuxCare onboarded. Target version 9.4.62 contains the complete fix. The vulnerable pattern (direct onBadMessage() calls returning null) is absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.62.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.62.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-09T15:11:05.515662+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.62.tuxcare0003 of org.eclipse.jetty.http2:http2-server. The target repository (Jetty 9.4.62) is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The vulnerability pattern\u2014absence of rate limiting on HTTP/2 frame processing (RST_STREAM, CONTINUATION, SETTINGS)\u2014is not present because the upstream vendor fix (commit 0f246d12090 by simone.bordet@gmail.com) was already included in the Jetty release that TuxCare onboarded. The fix adds rateControlOnEvent() checks to prevent rapid frame submission attacks and limits header block buffer growth. The fix was shipped in the upstream release 422 commits before TuxCare's first commit (d8aedf0e4210), making this an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (Jetty 9.4.62) is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The vulnerability pattern\u2014absence of rate limiting on HTTP/2 frame processing (RST_STREAM, CONTINUATION, SETTINGS)\u2014is not present because the upstream vendor fix (commit 0f246d12090 by simone.bordet@gmail.com) was already included in the Jetty release that TuxCare onboarded. The fix adds rateControlOnEvent() checks to prevent rapid frame submission attacks and limits header block buffer growth. The fix was shipped in the upstream release 422 commits before TuxCare's first commit (d8aedf0e4210), making this an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}