{
  "@id": "urn:uuid:e7595003-485c-47f5-a94c-886094886a56",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:05:28.850476+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty.http2:http2-server. Target version 9.4.65 is not affected by CVE-2022-2048. The vulnerability (denial of service via blocking selector threads when writing error responses to flow-control-exhausted HTTP/2 connections) was fixed in upstream Jetty 9.4.47 (June 2022). The fix changes error handling from synchronous calls to deferred execution via Runnables, preventing selector thread blockage. This upstream fix is present in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "Target version 9.4.65 is not affected by CVE-2022-2048. The vulnerability (denial of service via blocking selector threads when writing error responses to flow-control-exhausted HTTP/2 connections) was fixed in upstream Jetty 9.4.47 (June 2022). The fix changes error handling from synchronous calls to deferred execution via Runnables, preventing selector thread blockage. This upstream fix is present in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty.http2:http2-server. The target repository (jetty.project 9.4.65.tuxcare0001) is NOT affected by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The vulnerability fix, which adds rate limiting to HTTP/2 frame processing to prevent resource exhaustion attacks, is already present in the code. The fix was authored by upstream maintainer Simone Bordet (simone.bordet@gmail.com) and shipped in upstream release jetty-9.4.53.v20231009 (October 2023). TuxCare onboarded version 9.4.58.1 in December 2025, which already contained the complete fix. All required defenses are present and active: (1) Rate control on RST_STREAM, CONTINUATION, SETTINGS, and PUSH_PROMISE frames at 128 events/second, (2) maxCapacity checks on header block fragment accumulation to prevent unbounded memory growth, and (3) ENHANCE_YOUR_CALM error responses when limits are exceeded. The rate control is enabled by default in AbstractHTTP2ServerConnectionFactory and enforced on all HTTP/2 frame processing paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (jetty.project 9.4.65.tuxcare0001) is NOT affected by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The vulnerability fix, which adds rate limiting to HTTP/2 frame processing to prevent resource exhaustion attacks, is already present in the code. The fix was authored by upstream maintainer Simone Bordet (simone.bordet@gmail.com) and shipped in upstream release jetty-9.4.53.v20231009 (October 2023). TuxCare onboarded version 9.4.58.1 in December 2025, which already contained the complete fix. All required defenses are present and active: (1) Rate control on RST_STREAM, CONTINUATION, SETTINGS, and PUSH_PROMISE frames at 128 events/second, (2) maxCapacity checks on header block fragment accumulation to prevent unbounded memory growth, and (3) ENHANCE_YOUR_CALM error responses when limits are exceeded. The rate control is enabled by default in AbstractHTTP2ServerConnectionFactory and enforced on all HTTP/2 frame processing paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:01:01.522418+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:01:01.522418+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:35:44.733301+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:35:44.733301+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:35:44.733301+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    }
  ]
}