{
  "@id": "urn:uuid:13da9990-28c4-4a18-b4b5-4cdbe6e5383b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:05:28.850476+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T17:56:17.260017+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 CVE-2021-28163: Jetty 10.0.33 is not affected. The vulnerability where symlinked webapps directories could be deployed as static webapps (exposing directory contents) was fixed in upstream Jetty via commit c1ae922ab05 by Greg Wilkins. This fix was already present in Jetty 10.0.26+ when TuxCare onboarded the project. The defense uses Files.isSameFile() in WebAppProvider's filter to prevent monit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28163: Jetty 10.0.33 is not affected. The vulnerability where symlinked webapps directories could be deployed as static webapps (exposing directory contents) was fixed in upstream Jetty via commit c1ae922ab05 by Greg Wilkins. This fix was already present in Jetty 10.0.26+ when TuxCare onboarded the project. The defense uses Files.isSameFile() in WebAppProvider's filter to prevent monit..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T21:10:30.464414+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T21:10:30.464414+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T21:10:30.464414+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T22:44:40.243946+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T22:44:40.243946+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T22:44:40.243946+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    }
  ]
}