{
  "@id": "urn:uuid:2b93384c-dbde-4973-a34e-40443754a532",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:29:48.390816+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 is not present in the target. The vulnerability (blocking error response writes from the request processing path when HTTP/2 flow control is exhausted) was fixed in upstream Jetty 9.4.47 (May 2022) by commit be912d4315839405a8ae601f2e4ee0306867266e. The target version 9.4.66 was onboarded from upstream 9.4.58.1, which already included this fix. All error handling in HttpChannelOverHTTP2 now defers execution via Runnable lambdas instead of blocking synchronously.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 is not present in the target. The vulnerability (blocking error response writes from the request processing path when HTTP/2 flow control is exhausted) was fixed in upstream Jetty 9.4.47 (May 2022) by commit be912d4315839405a8ae601f2e4ee0306867266e. The target version 9.4.66 was onboarded from upstream 9.4.58.1, which already included this fix. All error handling in HttpChannelOverHTTP2 now defers execution via Runnable lambdas instead of blocking synchronously.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty.http2:http2-server. CVE-2023-44487 (HTTP/2 Rapid Reset) is NOT present in target Jetty 9.4.66. The vulnerability was fixed in upstream Jetty 9.4.53.v20231009 (Oct 2023) by Simone Bordet in commit 0f246d12090fb15b7b21dee8429f459fd792de53. This fix shipped in the upstream release that TuxCare onboarded. All HTTP/2 parsers (ResetBodyParser, SettingsBodyParser, ContinuationBodyParser) contain rate control checks via rateControlOnEvent() to limit RST_STREAM, SETTINGS, and CONTINUATION frames to 128 events/second. HeaderBlockFragments enforces maxCapacity limits to prevent unbounded header block growth. The rate control is active by default in AbstractHTTP2ServerConnectionFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset) is NOT present in target Jetty 9.4.66. The vulnerability was fixed in upstream Jetty 9.4.53.v20231009 (Oct 2023) by Simone Bordet in commit 0f246d12090fb15b7b21dee8429f459fd792de53. This fix shipped in the upstream release that TuxCare onboarded. All HTTP/2 parsers (ResetBodyParser, SettingsBodyParser, ContinuationBodyParser) contain rate control checks via rateControlOnEvent() to limit RST_STREAM, SETTINGS, and CONTINUATION frames to 128 events/second. HeaderBlockFragments enforces maxCapacity limits to prevent unbounded header block growth. The rate control is active by default in AbstractHTTP2ServerConnectionFactory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T23:30:48.716012+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 9.4.66.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T23:30:48.716012+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 9.4.66.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T23:30:48.716012+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 9.4.66.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T23:30:48.716012+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 9.4.66.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T23:30:48.716012+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 9.4.66.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.66.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T23:31:01.514561+00:00",
      "status_notes": "Vulnerability CVE-2026-95533 is fixed in version 9.4.66.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-95533"
      }
    }
  ]
}