{
  "@id": "urn:uuid:8ce9d608-fe74-4128-9ab8-383625976ea6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T14:43:58.583239+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-client-impl@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-client-impl@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T14:43:58.583239+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:javax-websocket-client-impl. not_affected \u2014 CVE-2022-2047: Target version 9.4.51.v20230217 is NOT AFFECTED. The fix for incorrect URI authority parsing (commit 4ca8afbbd66) was already included in upstream Jetty 9.4.47.v20220610, shipped months before the 9.4.51.v20230217 release that TuxCare onboarded. All defense mechanisms are present and active: isPathValidForAuthority() validation (lines 1042-1049), setAuthority/setPath/setPathQuery...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2047: Target version 9.4.51.v20230217 is NOT AFFECTED. The fix for incorrect URI authority parsing (commit 4ca8afbbd66) was already included in upstream Jetty 9.4.47.v20220610, shipped months before the 9.4.51.v20230217 release that TuxCare onboarded. All defense mechanisms are present and active: isPathValidForAuthority() validation (lines 1042-1049), setAuthority/setPath/setPathQuery..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-client-impl@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-client-impl@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:javax-websocket-client-impl.",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "action_statement": "Vulnerability CVE-2023-40167 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:javax-websocket-client-impl."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-client-impl@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-client-impl@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:javax-websocket-client-impl.",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "action_statement": "Vulnerability CVE-2024-6763 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:javax-websocket-client-impl."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-client-impl@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-client-impl@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:javax-websocket-client-impl.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      },
      "action_statement": "Vulnerability CVE-2025-11143 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:javax-websocket-client-impl."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-client-impl@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-client-impl@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:javax-websocket-client-impl.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      },
      "action_statement": "Vulnerability CVE-2026-2332 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:javax-websocket-client-impl."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-client-impl@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.websocket/javax-websocket-client-impl@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:javax-websocket-client-impl. not_affected \u2014 The target (Jetty 9.4.51.v20230217) is not affected by CVE-2026-8384. While the CVE describes a path normalization bypass in Jetty 12.1.8 where URIUtil.canonicalPath() fails to normalize paths containing `;/../` patterns due to incorrect slash-state tracking, Jetty 9.4.x uses a fundamentally different two-step architecture that prevents this vulnerability. The target's HttpURI.getDecodedPath() ...",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 The target (Jetty 9.4.51.v20230217) is not affected by CVE-2026-8384. While the CVE describes a path normalization bypass in Jetty 12.1.8 where URIUtil.canonicalPath() fails to normalize paths containing `;/../` patterns due to incorrect slash-state tracking, Jetty 9.4.x uses a fundamentally different two-step architecture that prevents this vulnerability. The target's HttpURI.getDecodedPath() ..."
    }
  ]
}