{
  "@id": "urn:uuid:b6b1fa9d-40ae-42b6-b630-453309c58a24",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T14:49:00.142928+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-client@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-client@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T14:49:00.142928+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-client. not_affected \u2014 Target version 10.0.30 is not affected by CVE-2022-2047. The vulnerability was fixed in upstream Jetty 10.0.10 via commit d1e64f469362bb9371d530cccded5ecb13fa1cb5, which was already present when TuxCare onboarded version 10.0.26. The fix includes validation that rejects relative paths (not starting with '/') when authority is present, path normalization prepending '/', and correct CONNECT URI p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 Target version 10.0.30 is not affected by CVE-2022-2047. The vulnerability was fixed in upstream Jetty 10.0.10 via commit d1e64f469362bb9371d530cccded5ecb13fa1cb5, which was already present when TuxCare onboarded version 10.0.26. The fix includes validation that rejects relative paths (not starting with '/') when authority is present, path normalization prepending '/', and correct CONNECT URI p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-client@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-client@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-client. Version 10.0.28 is not vulnerable. Summary: The target repository has the fix for CVE-2023-40167 applied. The Content-Length parsing code in HttpParser.java uses strict digit-only validation that rejects '+' prefix, preventing HTTP request smuggling attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: The target repository has the fix for CVE-2023-40167 applied. The Content-Length parsing code in HttpParser.java uses strict digit-only validation that rejects '+' prefix, preventing HTTP request smuggling attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-client@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-client@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-client. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "impact_statement": "fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-client@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-client@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 is fixed in version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-client.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-client@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-client@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 is fixed in version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-client.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      }
    }
  ]
}