{
  "@id": "urn:uuid:b0cf9b17-f92b-4c0b-969c-fed7683eadfc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T14:42:34.494037+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T14:42:34.494037+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 10.0.26-tuxcare.2 of org.eclipse.jetty.websocket:websocket-core-common. not_affected \u2014 CVE-2022-2047 affects Jetty's HttpURI class, which incorrectly parsed URIs like http://localhost;/path by treating 'localhost;' as the host. The target repository (Jetty 10.0.26) is NOT AFFECTED because the upstream fix (commit d1e64f469362bb9371d530cccded5ecb13fa1cb5) was already included in the Jetty 10.0.26 release that TuxCare onboarded. All defense mechanisms are present: (1) isPathValidFo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2047 affects Jetty's HttpURI class, which incorrectly parsed URIs like http://localhost;/path by treating 'localhost;' as the host. The target repository (Jetty 10.0.26) is NOT AFFECTED because the upstream fix (commit d1e64f469362bb9371d530cccded5ecb13fa1cb5) was already included in the Jetty 10.0.26 release that TuxCare onboarded. All defense mechanisms are present: (1) isPathValidFo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 does not affect version 10.0.26-tuxcare.2 of org.eclipse.jetty.websocket:websocket-core-common. not_affected \u2014 Target version 10.0.26 is NOT vulnerable to CVE-2023-40167. The upstream vendor (Eclipse Jetty) applied the fix in commit 003e46cae4d7 (2023-08-18) which replaced the permissive Long.parseLong() with strict character-by-character validation rejecting any non-digit characters including '+' prefix. This fix was already present in the upstream Jetty 10.0.26 release before TuxCare initialized their...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "impact_statement": "not_affected \u2014 Target version 10.0.26 is NOT vulnerable to CVE-2023-40167. The upstream vendor (Eclipse Jetty) applied the fix in commit 003e46cae4d7 (2023-08-18) which replaced the permissive Long.parseLong() with strict character-by-character validation rejecting any non-digit characters including '+' prefix. This fix was already present in the upstream Jetty 10.0.26 release before TuxCare initialized their..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 affects version 10.0.26-tuxcare.2 of org.eclipse.jetty.websocket:websocket-core-common.",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "action_statement": "Vulnerability CVE-2024-6763 affects version 10.0.26-tuxcare.2 of org.eclipse.jetty.websocket:websocket-core-common."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 affects version 10.0.26-tuxcare.2 of org.eclipse.jetty.websocket:websocket-core-common.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      },
      "action_statement": "Vulnerability CVE-2025-11143 affects version 10.0.26-tuxcare.2 of org.eclipse.jetty.websocket:websocket-core-common."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 affects version 10.0.26-tuxcare.2 of org.eclipse.jetty.websocket:websocket-core-common.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      },
      "action_statement": "Vulnerability CVE-2026-2332 affects version 10.0.26-tuxcare.2 of org.eclipse.jetty.websocket:websocket-core-common."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-core-common@10.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 10.0.26-tuxcare.2 of org.eclipse.jetty.websocket:websocket-core-common. not_affected \u2014 Jetty 10.0.26-tuxcare.1 is NOT affected by CVE-2026-8384. The vulnerability requires Jetty 12's specific architecture where encoded path processing and dot-segment normalization occur in a single method with slash-state tracking. Jetty 10 uses a two-step architecture (decodePath then canonicalPath) without slash-state tracking, preventing the vulnerability chain from forming.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 Jetty 10.0.26-tuxcare.1 is NOT affected by CVE-2026-8384. The vulnerability requires Jetty 12's specific architecture where encoded path processing and dot-segment normalization occur in a single method with slash-state tracking. Jetty 10 uses a two-step architecture (decodePath then canonicalPath) without slash-state tracking, preventing the vulnerability chain from forming."
    }
  ]
}