{
  "@id": "urn:uuid:d6dca456-c746-446d-ab46-50b0c63917d4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:56:00.071407+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T17:56:00.071407+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 CVE-2021-28163 is not present in Jetty 11.0.32. The vulnerability, where symlinked monitored directories (e.g., webapps) could be incorrectly deployed as static web applications, was fixed in upstream Jetty before version 11.0.26. The fix uses Files.isSameFile() to properly compare resources and detect when a scanned file is the same as a monitored directory, even through symlinks. This upstrea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28163 is not present in Jetty 11.0.32. The vulnerability, where symlinked monitored directories (e.g., webapps) could be incorrectly deployed as static web applications, was fixed in upstream Jetty before version 11.0.26. The fix uses Files.isSameFile() to properly compare resources and detect when a scanned file is the same as a monitored directory, even through symlinks. This upstrea..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    }
  ]
}