{
  "@id": "urn:uuid:66713ec6-a829-4fd3-8061-eb0c935ef247",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 36,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:46:34.171368+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-03T15:05:45.890515+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 describes predictable session IDs generated using java.util.Random in ancient Jetty versions (4.x-6.1.x, circa 2006). The target version 10.0.27 is not affected because the vulnerable pattern is not present. The code defaults to SecureRandom for session ID generation (DefaultSessionIdManager.java:359), with only an exceptional fallback to weak Random if SecureRandom instantiation ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 describes predictable session IDs generated using java.util.Random in ancient Jetty versions (4.x-6.1.x, circa 2006). The target version 10.0.27 is not affected because the vulnerable pattern is not present. The code defaults to SecureRandom for session ID generation (DefaultSessionIdManager.java:359), with only an exceptional fallback to weak Random if SecureRandom instantiation ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target (Jetty 10.0.27.tuxcare0004) is NOT AFFECTED by CVE-2011-4461. The vulnerability concerned unbounded form parameter processing enabling hash collision DoS attacks. The upstream fix (commit 085c79d7d6c by Greg Wilkins, 2011-12-30) added a maxFormKeys limit (default 1000) that stops parsing when exceeded. This fix was already present in upstream Jetty 10.0.26 before TuxCare onboarded it...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 The target (Jetty 10.0.27.tuxcare0004) is NOT AFFECTED by CVE-2011-4461. The vulnerability concerned unbounded form parameter processing enabling hash collision DoS attacks. The upstream fix (commit 085c79d7d6c by Greg Wilkins, 2011-12-30) added a maxFormKeys limit (default 1000) that stops parsing when exceeded. This fix was already present in upstream Jetty 10.0.26 before TuxCare onboarded it..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-06T17:46:34.171368+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.27 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.27 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-03T15:26:10.977883+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 is NOT present in Jetty 10.0.27. The vulnerability involved Windows path normalization allowing attackers to use escaped backslashes (e.g., 'aa\\\\/foo.txt') to bypass protected resource restrictions. The fix was implemented by upstream Jetty developer Joakim Erdfelt in commit 97af3d663fd (May 13, 2016) and was already present in the upstream Jetty 10.0.26 release that TuxCare onboa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 is NOT present in Jetty 10.0.27. The vulnerability involved Windows path normalization allowing attackers to use escaped backslashes (e.g., 'aa\\\\/foo.txt') to bypass protected resource restrictions. The fix was implemented by upstream Jetty developer Joakim Erdfelt in commit 97af3d663fd (May 13, 2016) and was already present in the upstream Jetty 10.0.26 release that TuxCare onboa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-03T12:39:55.396610+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. CVE-2017-7656 (HTTP Request Smuggling via ambiguous Content-Length/Transfer-Encoding headers) is NOT present in Jetty 10.0.27. The upstream fix commit a285deea42f by Greg Wilkins was already included in Jetty 10.0.26, which TuxCare onboarded. The fix adds validation to reject: (1) multiple Content-Length headers, (2) Content-Length + Transfer-Encoding: chunked combinations, and (3) excessively large chunk size values that could cause integer overflow. All three protections are present in HttpParser.java at lines 980-986, 998-999, 1800-1801, and 1912.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "CVE-2017-7656 (HTTP Request Smuggling via ambiguous Content-Length/Transfer-Encoding headers) is NOT present in Jetty 10.0.27. The upstream fix commit a285deea42f by Greg Wilkins was already included in Jetty 10.0.26, which TuxCare onboarded. The fix adds validation to reject: (1) multiple Content-Length headers, (2) Content-Length + Transfer-Encoding: chunked combinations, and (3) excessively large chunk size values that could cause integer overflow. All three protections are present in HttpParser.java at lines 980-986, 998-999, 1800-1801, and 1912.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. CVE-2017-7658 describes an HTTP Request Smuggling vulnerability in Jetty when handling multiple Content-Length headers or Content-Length combined with Transfer-Encoding: chunked. The target repository (Jetty 10.0.27) is NOT affected because the upstream vendor (Eclipse Jetty) fixed this vulnerability in commit a285deea42f (Greg Wilkins, May 2018), which introduced _hasContentLength and _hasTransferEncoding flags to track header presence and reject ambiguous requests with HTTP 400. This fix shipped in the upstream Jetty release that TuxCare later onboarded as version 10.0.26, making it present in the target's ancestry before any TuxCare modifications. In the default RFC7230 compliance mode, the checkViolation() method throws BadMessageException for both MULTIPLE_CONTENT_LENGTHS and TRANSFER_ENCODING_WITH_CONTENT_LENGTH violations, preventing the request smuggling attack. The vulnerable pattern is absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "CVE-2017-7658 describes an HTTP Request Smuggling vulnerability in Jetty when handling multiple Content-Length headers or Content-Length combined with Transfer-Encoding: chunked. The target repository (Jetty 10.0.27) is NOT affected because the upstream vendor (Eclipse Jetty) fixed this vulnerability in commit a285deea42f (Greg Wilkins, May 2018), which introduced _hasContentLength and _hasTransferEncoding flags to track header presence and reject ambiguous requests with HTTP 400. This fix shipped in the upstream Jetty release that TuxCare later onboarded as version 10.0.26, making it present in the target's ancestry before any TuxCare modifications. In the default RFC7230 compliance mode, the checkViolation() method throws BadMessageException for both MULTIPLE_CONTENT_LENGTHS and TRANSFER_ENCODING_WITH_CONTENT_LENGTH violations, preventing the request smuggling attack. The vulnerable pattern is absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-03T12:28:48.622691+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. CVE-2017-9735 timing channel attack is NOT present in target version 10.0.27. The upstream vendor (Eclipse Jetty) fixed this vulnerability through a series of commits (042f325f1cd, f3751d70787, 2baa1abe4b1, a7e8b4220a4) that replaced timing-vulnerable String.equals() with constant-time stringEquals() method in Password.java. All fixes were included in upstream release 10.0.26, which predates the first TuxCare commit (9818851111e \"setup 10.0.26\"). The current HEAD contains the complete, sophisticated constant-time comparison implementation that prevents password length inference and character-by-character timing attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 timing channel attack is NOT present in target version 10.0.27. The upstream vendor (Eclipse Jetty) fixed this vulnerability through a series of commits (042f325f1cd, f3751d70787, 2baa1abe4b1, a7e8b4220a4) that replaced timing-vulnerable String.equals() with constant-time stringEquals() method in Password.java. All fixes were included in upstream release 10.0.26, which predates the first TuxCare commit (9818851111e \"setup 10.0.26\"). The current HEAD contains the complete, sophisticated constant-time comparison implementation that prevents password length inference and character-by-character timing attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-10-31T18:00:35.631944+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target (Jetty 10.0.27.tuxcare0004, SHA 835774a2b95) is not affected by CVE-2018-12536. The vulnerability allowed path disclosure through InvalidPathException messages when malformed HTTP paths triggered exceptions during static file serving. The upstream fix (commit ad4dceb1c08 by Joakim Erdfelt, May 31, 2018) adds exception sanitization in ResourceContentFactory.getContent() that wraps any...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 The target (Jetty 10.0.27.tuxcare0004, SHA 835774a2b95) is not affected by CVE-2018-12536. The vulnerability allowed path disclosure through InvalidPathException messages when malformed HTTP paths triggered exceptions during static file serving. The upstream fix (commit ad4dceb1c08 by Joakim Erdfelt, May 31, 2018) adds exception sanitization in ResourceContentFactory.getContent() that wraps any..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. CVE-2018-12545 describes a DoS vulnerability where malicious clients can exhaust server resources by sending HTTP/2 SETTINGS frames with many settings (either in one large frame or across many small frames). The target (Jetty 10.0.27.tuxcare0004) is NOT AFFECTED because the upstream fix by Simone Bordet was already included in Jetty 10.0.26, which TuxCare onboarded as the base version. The fix adds a cumulative counter that tracks the total number of settings keys across all SETTINGS frames on a connection, rejecting the connection with ENHANCE_YOUR_CALM_ERROR when the count exceeds DEFAULT_MAX_KEYS (64). This defense is active by default and properly wired through the HTTP/2 parser initialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 describes a DoS vulnerability where malicious clients can exhaust server resources by sending HTTP/2 SETTINGS frames with many settings (either in one large frame or across many small frames). The target (Jetty 10.0.27.tuxcare0004) is NOT AFFECTED because the upstream fix by Simone Bordet was already included in Jetty 10.0.26, which TuxCare onboarded as the base version. The fix adds a cumulative counter that tracks the total number of settings keys across all SETTINGS frames on a connection, rejecting the connection with ENHANCE_YOUR_CALM_ERROR when the count exceeds DEFAULT_MAX_KEYS (64). This defense is active by default and properly wired through the HTTP/2 parser initialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-10-31T16:02:04.330844+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 XSS vulnerability in directory listing query parameter handling is NOT present in the target. The fix (commit ca77bd384a2 by upstream author Joakim Erdfelt, April 3, 2019) was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded. Current version 10.0.27.tuxcare0004 inherited this fix from upstream. The vulnerable pattern\u2014unvalidated query parameter reflec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 XSS vulnerability in directory listing query parameter handling is NOT present in the target. The fix (commit ca77bd384a2 by upstream author Joakim Erdfelt, April 3, 2019) was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded. Current version 10.0.27.tuxcare0004 inherited this fix from upstream. The vulnerable pattern\u2014unvalidated query parameter reflec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 is NOT present in this Jetty 10.0.27 target. The vulnerability (exposing full filesystem paths in directory listings) was fixed by upstream Jetty in April 2019 via commit 3d028ab2ca7. The fix modified Resource.java to use getFileName() (which extracts only the filename) instead of getName() (which returns the full path) when generating directory listing HTML. This upstream fix wa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 is NOT present in this Jetty 10.0.27 target. The vulnerability (exposing full filesystem paths in directory listings) was fixed by upstream Jetty in April 2019 via commit 3d028ab2ca7. The fix modified Resource.java to use getFileName() (which extracts only the filename) instead of getName() (which returns the full path) when generating directory listing HTML. This upstream fix wa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-10-31T16:25:03.051940+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 affects Jetty versions 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older. The target repository is running Jetty 10.0.27.tuxcare0004, which is significantly newer than the affected versions. The vulnerability (information disclosure of filesystem paths via context.toString() in 404 error pages) was fixed in the upstream Jetty project by commit 04c994712c0 authore...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 affects Jetty versions 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older. The target repository is running Jetty 10.0.27.tuxcare0004, which is significantly newer than the affected versions. The vulnerability (information disclosure of filesystem paths via context.toString() in 404 error pages) was fixed in the upstream Jetty project by commit 04c994712c0 authore..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-02T19:15:00.519823+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty 10.0.27 is NOT affected by CVE-2019-17632. The vulnerability (unescaped exception messages in HTML/JSON error responses) was fixed in upstream commit cf0df6e3ffd (Nov 2019) by Joakim Erdfelt, which added StringUtil.sanitizeXmlString() sanitization. This fix was already present in Jetty 10.0.26 when TuxCare onboarded it in Dec 2025. The defensive code sanitizes all exception message...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 10.0.27 is NOT affected by CVE-2019-17632. The vulnerability (unescaped exception messages in HTML/JSON error responses) was fixed in upstream commit cf0df6e3ffd (Nov 2019) by Joakim Erdfelt, which added StringUtil.sanitizeXmlString() sanitization. This fix was already present in Jetty 10.0.26 when TuxCare onboarded it in Dec 2025. The defensive code sanitizes all exception message..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. The target repository (Jetty 10.0.27.tuxcare0004) is NOT affected by CVE-2019-17638. The vulnerability was a double-release bug in response header overflow handling that could cause cross-client information disclosure. The fix (commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba) was applied by upstream developer Greg Wilkins on 2020-06-03 and was included in all Jetty 10.0.x releases starting from 10.0.0.beta1. TuxCare onboarded an already-fixed upstream version (10.0.26) in December 2025. The vulnerable code pattern (releasing buffer before exception check) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "The target repository (Jetty 10.0.27.tuxcare0004) is NOT affected by CVE-2019-17638. The vulnerability was a double-release bug in response header overflow handling that could cause cross-client information disclosure. The fix (commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba) was applied by upstream developer Greg Wilkins on 2020-06-03 and was included in all Jetty 10.0.x releases starting from 10.0.0.beta1. TuxCare onboarded an already-fixed upstream version (10.0.26) in December 2025. The vulnerable code pattern (releasing buffer before exception check) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-02T19:34:19.897070+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 is NOT present in jetty.project 10.0.27. The vulnerability involves unconsumed GZIP-compressed request body content from one HTTP request being prepended to a subsequent request's body on the same persistent connection, enabling attacker data injection. The upstream Eclipse Jetty project fixed this issue in commit 14f94f738df (Issue #5605) which was already present in the upstrea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 is NOT present in jetty.project 10.0.27. The vulnerability involves unconsumed GZIP-compressed request body content from one HTTP request being prepended to a subsequent request's body on the same persistent connection, enabling attacker data injection. The upstream Eclipse Jetty project fixed this issue in commit 14f94f738df (Issue #5605) which was already present in the upstrea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-02T19:26:56.575591+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 10.0.27 is not affected by CVE-2020-27223. The vulnerability (inefficient O(n\u00b2) bubble-sort algorithm in QuotedQualityCSV causing DoS via CPU exhaustion when processing HTTP headers with many quality parameters) was fixed by upstream Jetty in version 10.0.1 via commit 10e531756b972162eed402c44d0244f7f6b85131. The fix replaced the bubble-sort with an efficient O(n log n) compara...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 10.0.27 is not affected by CVE-2020-27223. The vulnerability (inefficient O(n\u00b2) bubble-sort algorithm in QuotedQualityCSV causing DoS via CPU exhaustion when processing HTTP headers with many quality parameters) was fixed by upstream Jetty in version 10.0.1 via commit 10e531756b972162eed402c44d0244f7f6b85131. The fix replaced the bubble-sort with an efficient O(n log n) compara..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-03T12:24:19.585233+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. CVE-2021-28165 is not present in Jetty 10.0.27. The vulnerability (unbounded buffer growth from oversized TLS frames causing CPU exhaustion) was fixed by upstream vendor Eclipse Jetty in commits 294b2ba02b6 and 039c7386d0f (March 2021). These fixes were already present in the upstream release 10.0.26 when TuxCare onboarded it. The target contains the defense code that checks for buffer space exhaustion and rejects oversized frames with SSLHandshakeException.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "CVE-2021-28165 is not present in Jetty 10.0.27. The vulnerability (unbounded buffer growth from oversized TLS frames causing CPU exhaustion) was fixed by upstream vendor Eclipse Jetty in commits 294b2ba02b6 and 039c7386d0f (March 2021). These fixes were already present in the upstream release 10.0.26 when TuxCare onboarded it. The target contains the defense code that checks for buffer space exhaustion and rejects oversized frames with SSLHandshakeException.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. Version 10.0.27 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "Version 10.0.27 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. CVE-2022-2191 is NOT present in target version 10.0.27. The vulnerability involves ByteBuffer memory leaks in SslConnection's error handling paths during TLS processing. The upstream fix (commit 66de7ba6180) added discardInputBuffers() and discardEncryptedOutputBuffer() methods that properly clear and release buffers in exception handlers. This fix was committed on 2022-06-15 by Ludovic Orban and shipped in upstream Jetty 10.0.10/10.0.11 (June 2022). The target is based on Jetty 10.0.26+ which includes this fix in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "CVE-2022-2191 is NOT present in target version 10.0.27. The vulnerability involves ByteBuffer memory leaks in SslConnection's error handling paths during TLS processing. The upstream fix (commit 66de7ba6180) added discardInputBuffers() and discardEncryptedOutputBuffer() methods that properly clear and release buffers in exception handlers. This fix was committed on 2022-06-15 by Ludovic Orban and shipped in upstream Jetty 10.0.10/10.0.11 (June 2022). The target is based on Jetty 10.0.26+ which includes this fix in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-10-31T15:36:43.900585+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26048 does not affect this target. The vulnerability was fixed in upstream Jetty 10.0.14 (released February 2023), and the target is version 10.0.27 which inherited the fix from upstream. Both defense mechanisms are present: (1) part count limiting via _maxParts field with default of 1000 parts, enforced in MultiPartFormInputStream.startPart(); (2) form content size limiting via formCo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26048 does not affect this target. The vulnerability was fixed in upstream Jetty 10.0.14 (released February 2023), and the target is version 10.0.27 which inherited the fix from upstream. Both defense mechanisms are present: (1) part count limiting via _maxParts field with default of 1000 parts, enforced in MultiPartFormInputStream.startPart(); (2) form content size limiting via formCo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-10-31T15:05:00.234196+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 (cookie smuggling via semicolons in quoted cookie values) is NOT present in target version 10.0.27. The upstream fix (commit 7b8c2c1bf08 by Simone Bordet, Feb 14 2023) introduced RFC6265CookieParser which properly rejects semicolons inside quoted cookie values by validating characters against RFC6265CookieOctets. This fix was already included in the upstream Jetty 10.0.26 release...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via semicolons in quoted cookie values) is NOT present in target version 10.0.27. The upstream fix (commit 7b8c2c1bf08 by Simone Bordet, Feb 14 2023) introduced RFC6265CookieParser which properly rejects semicolons inside quoted cookie values by validating characters against RFC6265CookieOctets. This fix was already included in the upstream Jetty 10.0.26 release..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. CVE-2024-13009 affects Jetty 9.4.0 to 9.4.56 where buffers could be incorrectly retained after gzip decompression errors, causing buffer reuse between requests. The target (Jetty 10.0.27) uses a different architecture (ContentProducer pattern) introduced in March 2020 that inherently prevents this issue. The defensive pattern (nulling content references after failure in AsyncContentProducer.failCurrentContent()) was part of the upstream Jetty 10.x design from its inception, predating the CVE discovery by over 4 years. This is not a backported fix but an architectural difference. The vulnerable 9.4.x code pattern does not exist in 10.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "CVE-2024-13009 affects Jetty 9.4.0 to 9.4.56 where buffers could be incorrectly retained after gzip decompression errors, causing buffer reuse between requests. The target (Jetty 10.0.27) uses a different architecture (ContentProducer pattern) introduced in March 2020 that inherently prevents this issue. The defensive pattern (nulling content references after failure in AsyncContentProducer.failCurrentContent()) was part of the upstream Jetty 10.x design from its inception, predating the CVE discovery by over 4 years. This is not a backported fix but an architectural difference. The vulnerable 9.4.x code pattern does not exist in 10.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. CVE-2024-7708 affects Jetty 10.0.0-10.0.22 and 11.0.0-11.0.22 with a memory leak when handling HTTP requests where body reading returns 0 bytes (particularly 100-Continue requests). The target version is 10.0.27.tuxcare0004, which already contains the upstream fix from Jetty 10.0.23 (commit 8259eabbc70 by Simone Bordet). The fix adds releaseRequestBuffer() calls when filled <= 0 bytes and in exception handlers, preventing buffer accumulation. This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded, so the vulnerable pattern was never present in the TuxCare-maintained 10.0.27 branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "CVE-2024-7708 affects Jetty 10.0.0-10.0.22 and 11.0.0-11.0.22 with a memory leak when handling HTTP requests where body reading returns 0 bytes (particularly 100-Continue requests). The target version is 10.0.27.tuxcare0004, which already contains the upstream fix from Jetty 10.0.23 (commit 8259eabbc70 by Simone Bordet). The fix adds releaseRequestBuffer() calls when filled <= 0 bytes and in exception handlers, preventing buffer accumulation. This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded, so the vulnerable pattern was never present in the TuxCare-maintained 10.0.27 branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. Version 10.0.27 is not vulnerable. Summary: The target repository (Jetty 10.0.27.tuxcare00001) already contains the complete fix for CVE-2024-8184. The vulnerable race condition in ThreadLimitHandler.getRemote() has been patched with atomic operations and reference counting, preventing the memory exhaustion DoS attack. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 10.0.27 is not vulnerable. Summary: The target repository (Jetty 10.0.27.tuxcare00001) already contains the complete fix for CVE-2024-8184. The vulnerable race condition in ThreadLimitHandler.getRemote() has been patched with atomic operations and reference counting, preventing the memory exhaustion DoS attack. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 10.0.27 is not affected by CVE-2026-10051. The vulnerability describes HTTP request trailers persisting across requests on keep-alive connections in Jetty 12.x due to a missing reset of the connection-scoped _trailers field. Jetty 10.x uses a different architecture (HttpChannelOverHttp vs internal/HttpConnection) and properly resets the _trailers field via the recycle() method called betw...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 10.0.27 is not affected by CVE-2026-10051. The vulnerability describes HTTP request trailers persisting across requests on keep-alive connections in Jetty 12.x due to a missing reset of the connection-scoped _trailers field. Jetty 10.x uses a different architecture (HttpChannelOverHttp vs internal/HttpConnection) and properly resets the _trailers field via the recycle() method called betw..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server. Version 10.0.27 is not vulnerable. Summary: Target repository Jetty 10.0.27 is NOT vulnerable to CVE-2026-1605. The vulnerability affects only Jetty 12.0.0-12.0.31 and 12.1.0-12.1.5 due to architectural changes in that version series. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 10.0.27 is not vulnerable. Summary: Target repository Jetty 10.0.27 is NOT vulnerable to CVE-2026-1605. The vulnerability affects only Jetty 12.0.0-12.0.31 and 12.1.0-12.1.5 due to architectural changes in that version series. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    }
  ]
}