{
  "@id": "urn:uuid:33c1963b-8b5e-4f52-9443-15e726a0ef4b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 36,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T10:27:00.246457+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:06:35.446673+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 describes predictable session ID generation in Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3 due to use of java.util.Random. The target repository (Jetty 10.0.28.tuxcare0003) is NOT affected. The vulnerability was fixed by upstream Jetty in April 2010 (commit c3275730b913, JETTY-1202) by replacing java.util.Random with java.security.SecureRandom for session ID generat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 describes predictable session ID generation in Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3 due to use of java.util.Random. The target repository (Jetty 10.0.28.tuxcare0003) is NOT affected. The vulnerability was fixed by upstream Jetty in April 2010 (commit c3275730b913, JETTY-1202) by replacing java.util.Random with java.security.SecureRandom for session ID generat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 (hash collision DoS via unlimited form parameters) is NOT present in Jetty 10.0.28. The fix limiting form parameter keys to 1000 by default was applied by upstream Jetty developer Greg Wilkins in commit 085c79d7d6c (Dec 30, 2011) and was already present in the upstream Jetty 10.0.26 release when TuxCare onboarded it. The vulnerable pattern (unlimited form parameter parsing enablin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-4461 (hash collision DoS via unlimited form parameters) is NOT present in Jetty 10.0.28. The fix limiting form parameter keys to 1000 by default was applied by upstream Jetty developer Greg Wilkins in commit 085c79d7d6c (Dec 30, 2011) and was already present in the upstream Jetty 10.0.26 release when TuxCare onboarded it. The vulnerable pattern (unlimited form parameter parsing enablin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T17:46:34.171368+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.28 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.28 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:29:31.146838+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, where path normalization in PathResource allowed bypassing protected resource restrictions via URLs with escaped backslashes (%5C). The target version 10.0.28 is NOT vulnerable because the upstream fix (commit 97af3d663fd by Joakim Erdfelt, May 13, 2016) was already included in the upstream release that TuxCare started from. The...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, where path normalization in PathResource allowed bypassing protected resource restrictions via URLs with escaped backslashes (%5C). The target version 10.0.28 is NOT vulnerable because the upstream fix (commit 97af3d663fd by Joakim Erdfelt, May 13, 2016) was already included in the upstream release that TuxCare started from. The..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:41:38.446812+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. Target Jetty 10.0.28 is not affected by CVE-2017-7656 (HTTP Request Smuggling via ambiguous Content-Length). The upstream fix (commit a285deea42f by gregw@webtide.com, 2018-05-17) was already present in the upstream Jetty 10.0.26 release when TuxCare onboarded it. The fix introduces strict validation that rejects requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding: chunked headers. The default compliance mode (RFC7230) enforces these restrictions, blocking the vulnerability. Only non-default RFC2616_LEGACY mode would allow these violations, matching the CVE's description that 9.4.x is vulnerable only \"with RFC2616 compliance enabled\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "Target Jetty 10.0.28 is not affected by CVE-2017-7656 (HTTP Request Smuggling via ambiguous Content-Length). The upstream fix (commit a285deea42f by gregw@webtide.com, 2018-05-17) was already present in the upstream Jetty 10.0.26 release when TuxCare onboarded it. The fix introduces strict validation that rejects requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding: chunked headers. The default compliance mode (RFC7230) enforces these restrictions, blocking the vulnerability. Only non-default RFC2616_LEGACY mode would allow these violations, matching the CVE's description that 9.4.x is vulnerable only \"with RFC2616 compliance enabled\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7658 HTTP Request Smuggling vulnerability is NOT present in Jetty 10.0.28. The upstream vendor (Eclipse Jetty) fixed this vulnerability in commit a285deea42f (May 2018) by adding validation to reject HTTP requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding: chunked headers. This fix was already included in the upstream Jetty 10.0.28 release that TuxCare onboarded, before any TuxCare modifications. The defense is active by default using RFC7230 compliance mode, which strictly enforces HTTP standards and rejects the smuggling patterns.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "CVE-2017-7658 HTTP Request Smuggling vulnerability is NOT present in Jetty 10.0.28. The upstream vendor (Eclipse Jetty) fixed this vulnerability in commit a285deea42f (May 2018) by adding validation to reject HTTP requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding: chunked headers. This fix was already included in the upstream Jetty 10.0.28 release that TuxCare onboarded, before any TuxCare modifications. The defense is active by default using RFC7230 compliance mode, which strictly enforces HTTP standards and rejects the smuggling patterns.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:29:43.002778+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-9735 timing channel vulnerability is NOT present in target version 10.0.28. All upstream fix commits (042f325f1cd, f3751d70787, 2baa1abe4b1, a7e8b4220a4) that replace timing-vulnerable string comparisons with constant-time stringEquals() and byteEquals() methods were already included in the upstream release that TuxCare onboarded. The fix was authored by upstream developers (Simone Bordet, Greg Wilkins) and shipped before TuxCare's first commit (cf975b23e1f). Analysis confirmed Password.java, Credential.java, and DigestAuthenticator.java all use constant-time comparisons that prevent timing side-channel attacks by always iterating through full string length with bitwise AND accumulation and modulo-based indexing to hide length differences.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 timing channel vulnerability is NOT present in target version 10.0.28. All upstream fix commits (042f325f1cd, f3751d70787, 2baa1abe4b1, a7e8b4220a4) that replace timing-vulnerable string comparisons with constant-time stringEquals() and byteEquals() methods were already included in the upstream release that TuxCare onboarded. The fix was authored by upstream developers (Simone Bordet, Greg Wilkins) and shipped before TuxCare's first commit (cf975b23e1f). Analysis confirmed Password.java, Credential.java, and DigestAuthenticator.java all use constant-time comparisons that prevent timing side-channel attacks by always iterating through full string length with bitwise AND accumulation and modulo-based indexing to hide length differences.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T18:02:59.085384+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 affects Eclipse Jetty 9.x where invalid path characters trigger InvalidPathException containing full filesystem paths in error responses. The target (Jetty 10.0.28.tuxcare0003) contains the upstream vendor fix (commit ad4dceb1c08) that prevents this disclosure by catching all exceptions during resource path resolution and re-throwing sanitized InvalidPathException with only the u...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 affects Eclipse Jetty 9.x where invalid path characters trigger InvalidPathException containing full filesystem paths in error responses. The target (Jetty 10.0.28.tuxcare0003) contains the upstream vendor fix (commit ad4dceb1c08) that prevents this disclosure by catching all exceptions during resource path resolution and re-throwing sanitized InvalidPathException with only the u..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. Target Jetty 10.0.28 is NOT AFFECTED by CVE-2018-12545. The vulnerability affected Jetty 9.3.x and 9.4.x with missing protections against DoS via excessive HTTP/2 SETTINGS frames. The required fixes (maxSettingsKeys limit and rate control) were applied by upstream Jetty maintainer Simone Bordet in July 2018 (Issue #2722) and August 2019 (Issue #3978), before Jetty 10.0 was released. Both defenses are present in the target code at SettingsBodyParser.java lines 193-199 (key count limit) and lines 221-228 (rate control), preventing the attack chain from SETTINGS frames to resource exhaustion DoS.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "Target Jetty 10.0.28 is NOT AFFECTED by CVE-2018-12545. The vulnerability affected Jetty 9.3.x and 9.4.x with missing protections against DoS via excessive HTTP/2 SETTINGS frames. The required fixes (maxSettingsKeys limit and rate control) were applied by upstream Jetty maintainer Simone Bordet in July 2018 (Issue #2722) and August 2019 (Issue #3978), before Jetty 10.0 was released. Both defenses are present in the target code at SettingsBodyParser.java lines 193-199 (key count limit) and lines 221-228 (rate control), preventing the attack chain from SETTINGS frames to resource exhaustion DoS.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:04:12.888747+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 affects Eclipse Jetty versions 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older. The target repository is version 10.0.28.tuxcare0003, which already contains the upstream fix from commit ca77bd384a2 (released in Jetty 9.2.27.v20190403 on April 3, 2019). The fix was already present in the upstream release that TuxCare onboarded, making the target not affected by this XSS v...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 affects Eclipse Jetty versions 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older. The target repository is version 10.0.28.tuxcare0003, which already contains the upstream fix from commit ca77bd384a2 (released in Jetty 9.2.27.v20190403 on April 3, 2019). The fix was already present in the upstream release that TuxCare onboarded, making the target not affected by this XSS v..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 affects Eclipse Jetty versions 9.2.27, 9.3.26, and 9.4.16, causing exposure of fully qualified filesystem paths in directory listings on Windows. The target repository (Jetty 10.0.28.tuxcare0003) is NOT vulnerable because the upstream fix was already present in the release that TuxCare onboarded. The vulnerable code pattern (using getName() with naive string manipulation to extra...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 affects Eclipse Jetty versions 9.2.27, 9.3.26, and 9.4.16, causing exposure of fully qualified filesystem paths in directory listings on Windows. The target repository (Jetty 10.0.28.tuxcare0003) is NOT vulnerable because the upstream fix was already present in the release that TuxCare onboarded. The vulnerable code pattern (using getName() with naive string manipulation to extra..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:29:00.107208+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 is NOT present in Jetty 10.0.28.tuxcare0003. The vulnerability (information disclosure of base resource directory paths in 404 error responses) was fixed upstream by Joakim Erdfelt in April 2019 (commit 04c99471). This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded in December 2025. The target's DefaultHandler does not call context.toString()...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 is NOT present in Jetty 10.0.28.tuxcare0003. The vulnerability (information disclosure of base resource directory paths in 404 error responses) was fixed upstream by Joakim Erdfelt in April 2019 (commit 04c99471). This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded in December 2025. The target's DefaultHandler does not call context.toString()..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:15:00.519823+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 is NOT present in Eclipse Jetty 10.0.28.tuxcare0003. The vulnerability involved unescaped exception messages in error responses (HTML and JSON) that could enable XSS attacks. The upstream fix (commit cf0df6e3ffd by Joakim Erdfelt) was already included in Jetty 10.0.26, which served as TuxCare's baseline for onboarding. The target repository contains the complete sanitization impl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 is NOT present in Eclipse Jetty 10.0.28.tuxcare0003. The vulnerability involved unescaped exception messages in error responses (HTML and JSON) that could enable XSS attacks. The upstream fix (commit cf0df6e3ffd by Joakim Erdfelt) was already included in Jetty 10.0.26, which served as TuxCare's baseline for onboarding. The target repository contains the complete sanitization impl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2019-17638 affects Jetty 9.4.27-9.4.29 (released Feb-May 2020). The vulnerability involves double-release of ByteBuffer during HTTP 431 response (headers too large), leading to information disclosure across client sessions. The upstream fix (commit ff8ae56fa93, authored by Greg Wilkins on June 3, 2020) is present in target version 10.0.28. The fix was shipped in the upstream Jetty 10.0.28 release, not backported by TuxCare. Target is not affected because the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "CVE-2019-17638 affects Jetty 9.4.27-9.4.29 (released Feb-May 2020). The vulnerability involves double-release of ByteBuffer during HTTP 431 response (headers too large), leading to information disclosure across client sessions. The upstream fix (commit ff8ae56fa93, authored by Greg Wilkins on June 3, 2020) is present in target version 10.0.28. The fix was shipped in the upstream Jetty 10.0.28 release, not backported by TuxCare. Target is not affected because the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:33:53.776679+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 10.0.28 repository is NOT AFFECTED by CVE-2020-27218 (GZIP request body inflation vulnerability). The vulnerability pattern has been removed by upstream fixes that were already present in the Jetty 10.0.0 release and all subsequent versions. The fix commits (including 14f94f738df5adf68549749d01d4f9d97ea51452) were authored by upstream Jetty developers in November 2020 and are a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 10.0.28 repository is NOT AFFECTED by CVE-2020-27218 (GZIP request body inflation vulnerability). The vulnerability pattern has been removed by upstream fixes that were already present in the Jetty 10.0.0 release and all subsequent versions. The fix commits (including 14f94f738df5adf68549749d01d4f9d97ea51452) were authored by upstream Jetty developers in November 2020 and are a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:28:01.029212+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223 affects Jetty's QuotedQualityCSV class with an O(n\u00b3) bubble-sort algorithm causing DoS via CPU exhaustion when parsing headers with many quality parameters. The target (Jetty 10.0.28) contains the FIXED version with stream-based O(n log n) sorting. The fix was authored by upstream maintainer Joakim Erdfelt (joakim.erdfelt@gmail.com) in commit 10e531756b9 and shipped in Jetty 10.0...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27223 affects Jetty's QuotedQualityCSV class with an O(n\u00b3) bubble-sort algorithm causing DoS via CPU exhaustion when parsing headers with many quality parameters. The target (Jetty 10.0.28) contains the FIXED version with stream-based O(n log n) sorting. The fix was authored by upstream maintainer Joakim Erdfelt (joakim.erdfelt@gmail.com) in commit 10e531756b9 and shipped in Jetty 10.0..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:24:19.585233+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2021-28165 fix is already present in target Jetty 10.0.28.tuxcare0003. The vulnerability allowed large TLS frames (>17408 bytes) to cause infinite loop and 100% CPU usage. The fix (commits 039c7386d0f and 294b2ba02b6) adds buffer space validation that throws SSLHandshakeException when encrypted input buffer is exhausted, preventing the infinite loop. This fix was authored by upstream Jetty maintainer Simone Bordet and shipped in the upstream release that TuxCare onboarded at version 10.0.26, before the current 10.0.28 version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "CVE-2021-28165 fix is already present in target Jetty 10.0.28.tuxcare0003. The vulnerability allowed large TLS frames (>17408 bytes) to cause infinite loop and 100% CPU usage. The fix (commits 039c7386d0f and 294b2ba02b6) adds buffer space validation that throws SSLHandshakeException when encrypted input buffer is exhausted, preventing the infinite loop. This fix was authored by upstream Jetty maintainer Simone Bordet and shipped in the upstream release that TuxCare onboarded at version 10.0.26, before the current 10.0.28 version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "Version 10.0.28 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. The target repository (Jetty 10.0.28.tuxcare0003) is NOT affected by CVE-2022-2191. The vulnerability fix (commit 66de7ba6180) was already included in the upstream Jetty release that TuxCare onboarded. The fix adds proper buffer cleanup on TLS exception paths, preventing ByteBuffer leaks. All required defense methods (discardInputBuffers, discardEncryptedOutputBuffer) are present and properly invoked in exception handlers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "The target repository (Jetty 10.0.28.tuxcare0003) is NOT affected by CVE-2022-2191. The vulnerability fix (commit 66de7ba6180) was already included in the upstream Jetty release that TuxCare onboarded. The fix adds proper buffer cleanup on TLS exception paths, preventing ByteBuffer leaks. All required defense methods (discardInputBuffers, discardEncryptedOutputBuffer) are present and properly invoked in exception handlers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:39:10.455880+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty 10.0.28 is not affected by CVE-2023-26048. The vulnerability was fixed by upstream Jetty in commit 1042cdb8a54 (Lachlan Roberts, Feb 13 2023), which was already included in Jetty 10.0.26 when TuxCare onboarded that release. Both required defenses are present and active by default: (1) part count limit via _maxParts with default 1000 parts, and (2) form content size limit for non-fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 10.0.28 is not affected by CVE-2023-26048. The vulnerability was fixed by upstream Jetty in commit 1042cdb8a54 (Lachlan Roberts, Feb 13 2023), which was already included in Jetty 10.0.26 when TuxCare onboarded that release. Both required defenses are present and active by default: (1) part count limit via _maxParts with default 1000 parts, and (2) form content size limit for non-fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-09T10:27:00.246457+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: the upstream fix is already in this version's git history (commits 1be1401b, 7b8c2c1b). Advisories: GitHub, NVD and Snyk say fixed in 10.0.14, and this version is later on the same line; cve.org says not affected. Confirmed not affected by the Java ELS team review on 2026-11-06.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "Prechecker: the upstream fix is already in this version's git history (commits 1be1401b, 7b8c2c1b). Advisories: GitHub, NVD and Snyk say fixed in 10.0.14, and this version is later on the same line; cve.org says not affected. Confirmed not affected by the Java ELS team review on 2026-11-06."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2024-13009 affects Eclipse Jetty 9.4.0-9.4.56 where buffers are incorrectly retained after gzip errors. The target version 10.0.28 uses a different architecture (AsyncContentProducer) that properly nulls content buffers on interceptor failures via failCurrentContent(), preventing buffer reuse across requests. This defensive pattern has been present since AsyncContentProducer's initial implementation in March 2020, predating the CVE disclosure.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "CVE-2024-13009 affects Eclipse Jetty 9.4.0-9.4.56 where buffers are incorrectly retained after gzip errors. The target version 10.0.28 uses a different architecture (AsyncContentProducer) that properly nulls content buffers on interceptor failures via failCurrentContent(), preventing buffer reuse across requests. This defensive pattern has been present since AsyncContentProducer's initial implementation in March 2020, predating the CVE disclosure.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. Target version 10.0.28 is not affected by CVE-2024-7708. The vulnerability (memory leak when reading 0 bytes) was fixed in upstream Jetty 10.0.23 via commit 8259eabbc70 by Simone Bordet. This fix was already present in the upstream 10.0.26 release that TuxCare onboarded. The target contains the complete fix: HttpConnection.fillRequestBuffer() properly releases request buffers when filled <= 0 bytes and cleans up buffers in exception handlers. The vulnerable pattern (missing releaseRequestBuffer() call for 0-byte reads) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "Target version 10.0.28 is not affected by CVE-2024-7708. The vulnerability (memory leak when reading 0 bytes) was fixed in upstream Jetty 10.0.23 via commit 8259eabbc70 by Simone Bordet. This fix was already present in the upstream 10.0.26 release that TuxCare onboarded. The target contains the complete fix: HttpConnection.fillRequestBuffer() properly releases request buffers when filled <= 0 bytes and cleans up buffers in exception handlers. The vulnerable pattern (missing releaseRequestBuffer() call for 0-byte reads) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 affects version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "action_statement": "Vulnerability CVE-2026-10051 affects version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 affects version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server, and is fixed in 10.0.28.tuxcare0003.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "action_statement": "Vulnerability CVE-2026-6790 affects version 10.0.28.tuxcare0001 of org.eclipse.jetty:jetty-server, and is fixed in 10.0.28.tuxcare0003."
    }
  ]
}