{
  "@id": "urn:uuid:f0ab66eb-f60e-417b-a3c0-d685c02e41c3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 36,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:05:28.850476+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:09:27.722120+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 affects Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3, where session identifiers were generated using predictable java.util.Random. The target version 10.0.33.tuxcare0001 is not affected because it uses SecureRandom for session ID generation by default (with a fallback to Random only if SecureRandom initialization fails). The fix was introduced by upstream Jetty devel...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 affects Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3, where session identifiers were generated using predictable java.util.Random. The target version 10.0.33.tuxcare0001 is not affected because it uses SecureRandom for session ID generation by default (with a fallback to Random only if SecureRandom initialization fails). The fix was introduced by upstream Jetty devel..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 10.0.33 is not affected by CVE-2011-4461. The upstream fix (commit 085c79d7d6cfbccc02821ffdb64968593df3e0bf by Greg Wilkins) was already present in the upstream Jetty release that TuxCare onboarded. The defense limits form parameter keys to 1000 by default, preventing hash collision DoS attacks. The vulnerable pattern (unlimited form parameter processing) is not present in the ta...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 Target version 10.0.33 is not affected by CVE-2011-4461. The upstream fix (commit 085c79d7d6cfbccc02821ffdb64968593df3e0bf by Greg Wilkins) was already present in the upstream Jetty release that TuxCare onboarded. The defense limits form parameter keys to 1000 by default, preventing hash collision DoS attacks. The vulnerable pattern (unlimited form parameter processing) is not present in the ta..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T17:48:00.459476+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.33 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.33 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:32:29.747187+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, allowing path normalization bypass via escaped backslashes. The target (Jetty 10.0.33) contains the upstream fix committed in May 2016 (commit 97af3d663fd) which was already present in the upstream release 10.0.26 that TuxCare onboarded. The fix enhances PathResource.checkAliasPath() to detect when the original URI differs from ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, allowing path normalization bypass via escaped backslashes. The target (Jetty 10.0.33) contains the upstream fix committed in May 2016 (commit 97af3d663fd) which was already present in the upstream release 10.0.26 that TuxCare onboarded. The fix enhances PathResource.checkAliasPath() to detect when the original URI differs from ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:44:53.933368+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. Target version 10.0.33 is NOT AFFECTED by CVE-2017-7656 (HTTP Request Smuggling). The upstream fix by Greg Wilkins (commit a285deea42f) was already present in the upstream release when TuxCare onboarded version 10.0.26. The defense code actively rejects requests containing both Content-Length and Transfer-Encoding headers or duplicate Content-Length headers via the compliance violation system. With the default RFC7230 compliance mode, the vulnerable pattern cannot be exploited. The vulnerability would only manifest if an administrator explicitly reconfigures the server to use non-default LEGACY or RFC2616_LEGACY compliance modes, which permit these RFC violations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "Target version 10.0.33 is NOT AFFECTED by CVE-2017-7656 (HTTP Request Smuggling). The upstream fix by Greg Wilkins (commit a285deea42f) was already present in the upstream release when TuxCare onboarded version 10.0.26. The defense code actively rejects requests containing both Content-Length and Transfer-Encoding headers or duplicate Content-Length headers via the compliance violation system. With the default RFC7230 compliance mode, the vulnerable pattern cannot be exploited. The vulnerability would only manifest if an administrator explicitly reconfigures the server to use non-default LEGACY or RFC2616_LEGACY compliance modes, which permit these RFC violations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:46:12.447284+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. Jetty 10.0.33 is not affected by CVE-2017-7657. The vulnerability involving integer overflow in chunk length parsing has been addressed by an upstream fix (commit 897cb017d78) that implements equivalent protections: a 15-hex-digit limit preventing excessive chunk sizes, negative overflow detection after multiplication, rejection of multiple Content-Length headers, and rejection of requests with both Content-Length and Transfer-Encoding headers. This fix was authored by upstream developer Lachlan Roberts and merged into the codebase before TuxCare's maintenance period began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "impact_statement": "Jetty 10.0.33 is not affected by CVE-2017-7657. The vulnerability involving integer overflow in chunk length parsing has been addressed by an upstream fix (commit 897cb017d78) that implements equivalent protections: a 15-hex-digit limit preventing excessive chunk sizes, negative overflow detection after multiplication, rejection of multiple Content-Length headers, and rejection of requests with both Content-Length and Transfer-Encoding headers. This fix was authored by upstream developer Lachlan Roberts and merged into the codebase before TuxCare's maintenance period began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:22:29.685630+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7658 is NOT present in target version 10.0.33. The fix for HTTP Request Smuggling (preventing duplicate Content-Length headers and Content-Length + Transfer-Encoding combinations) was introduced in upstream commit a285deea42f (Issue #2529 by Greg Wilkins, May 2018) and shipped in the upstream release before TuxCare onboarded version 10.0.26. The target code implements the defense via _hasContentLength tracking and checkViolation() calls that reject ambiguous header combinations in RFC7230 compliance mode (the default). The vulnerable pattern described in CVE-2017-7658 is not present in the default shipped configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "CVE-2017-7658 is NOT present in target version 10.0.33. The fix for HTTP Request Smuggling (preventing duplicate Content-Length headers and Content-Length + Transfer-Encoding combinations) was introduced in upstream commit a285deea42f (Issue #2529 by Greg Wilkins, May 2018) and shipped in the upstream release before TuxCare onboarded version 10.0.26. The target code implements the defense via _hasContentLength tracking and checkViolation() calls that reject ambiguous header combinations in RFC7230 compliance mode (the default). The vulnerable pattern described in CVE-2017-7658 is not present in the default shipped configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:34:57.157354+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-9735 (timing channel attack in Password.java) is NOT present in target version 10.0.33. The vulnerability was fixed in upstream Jetty releases via constant-time comparison methods (stringEquals/byteEquals) that replace variable-time String.equals() and Arrays.equals() calls. These fixes were authored by Simone Bordet (commit 042f325f1cd, May 2017) and improved by Lachlan Roberts (commit e727ad893d2). Both commits were already present in the upstream Jetty 10.0.26 release that TuxCare onboarded, making this an upstream-shipped fix rather than a TuxCare backport. All password comparison code paths in the target correctly use the constant-time methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 (timing channel attack in Password.java) is NOT present in target version 10.0.33. The vulnerability was fixed in upstream Jetty releases via constant-time comparison methods (stringEquals/byteEquals) that replace variable-time String.equals() and Arrays.equals() calls. These fixes were authored by Simone Bordet (commit 042f325f1cd, May 2017) and improved by Lachlan Roberts (commit e727ad893d2). Both commits were already present in the upstream Jetty 10.0.26 release that TuxCare onboarded, making this an upstream-shipped fix rather than a TuxCare backport. All password comparison code paths in the target correctly use the constant-time methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T18:17:48.822898+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target is not affected by CVE-2018-12536. The vulnerability (path disclosure via InvalidPathException) is prevented by two upstream defenses already present in Jetty 10.0.33: (1) ResourceContentFactory.getContent() sanitizes all exceptions by wrapping them in a try-catch that replaces full paths with user-provided paths only (commit ad4dceb1c08, Issue #2560, May 2018), and (2) ResourceServi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 The target is not affected by CVE-2018-12536. The vulnerability (path disclosure via InvalidPathException) is prevented by two upstream defenses already present in Jetty 10.0.33: (1) ResourceContentFactory.getContent() sanitizes all exceptions by wrapping them in a try-catch that replaces full paths with user-provided paths only (commit ad4dceb1c08, Issue #2560, May 2018), and (2) ResourceServi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2018-12545 is NOT present in Jetty 10.0.33. The vulnerability (DoS via unlimited SETTINGS frame key-value pairs) was fixed by upstream commit 9eca404 (July 2018) which added maxSettingsKeys limiting (default 64) and cumulative per-connection key counting with ENHANCE_YOUR_CALM_ERROR rejection. This fix was already present in the upstream Jetty 10.0.26 release when TuxCare onboarded the project (first TuxCare commit e2a9c9de56a, Dec 2025). The fix is an upstream contribution by simone.bordet@gmail.com, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 is NOT present in Jetty 10.0.33. The vulnerability (DoS via unlimited SETTINGS frame key-value pairs) was fixed by upstream commit 9eca404 (July 2018) which added maxSettingsKeys limiting (default 64) and cumulative per-connection key counting with ENHANCE_YOUR_CALM_ERROR rejection. This fix was already present in the upstream Jetty 10.0.26 release when TuxCare onboarded the project (first TuxCare commit e2a9c9de56a, Dec 2025). The fix is an upstream contribution by simone.bordet@gmail.com, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:17:00.105151+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 affects Jetty's directory listing feature when handling specially formatted URLs with XSS payloads. The target repository (Jetty 10.0.33) contains the upstream fix authored by Joakim Erdfelt (commit 7b774d82e82) which was already present in the upstream release before TuxCare onboarded this version. The fix adds a getFileName() method that properly URL-decodes filenames and uses ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 affects Jetty's directory listing feature when handling specially formatted URLs with XSS payloads. The target repository (Jetty 10.0.33) contains the upstream fix authored by Joakim Erdfelt (commit 7b774d82e82) which was already present in the upstream release before TuxCare onboarded this version. The fix adds a getFileName() method that properly URL-decodes filenames and uses ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 10.0.33.tuxcare0001) is NOT AFFECTED by CVE-2019-10246. The vulnerability involved exposing fully qualified filesystem paths in directory listing HTML when directory listing was enabled. The fix (commit 7b774d82e82) modified the getListHTML() method in Resource.java to use a new getFileName() method that extracts only the filename (last path segment) instead of usin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 10.0.33.tuxcare0001) is NOT AFFECTED by CVE-2019-10246. The vulnerability involved exposing fully qualified filesystem paths in directory listing HTML when directory listing was enabled. The fix (commit 7b774d82e82) modified the getListHTML() method in Resource.java to use a new getFileName() method that extracts only the filename (last path segment) instead of usin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:40:31.644157+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 is not present in target version 10.0.33. The vulnerability (information disclosure of filesystem directory paths in 404 error pages via context.toString() calls) was fixed upstream by Joakim Erdfelt in commits 04c994712 and 9f506e4123b (Issue #3555, dated 2019-04-15) before TuxCare onboarded this version line. The target's DefaultHandler.java contains no context.toString() calls...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 is not present in target version 10.0.33. The vulnerability (information disclosure of filesystem directory paths in 404 error pages via context.toString() calls) was fixed upstream by Joakim Erdfelt in commits 04c994712 and 9f506e4123b (Issue #3555, dated 2019-04-15) before TuxCare onboarded this version line. The target's DefaultHandler.java contains no context.toString() calls..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:18:00.143361+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 affects Jetty 9.4.21-23 (XSS via unescaped exception messages in error pages). The target version (Jetty 10.0.33.tuxcare0001) does not contain the vulnerable code pattern. The upstream fix (commits 9e40fc9a6fb and cf0df6e3ffd by Joakim Erdfelt) was already included in Jetty 10.0.0, the first stable 10.x release. TuxCare onboarded Jetty 10.0.26, which already contained this upstre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 affects Jetty 9.4.21-23 (XSS via unescaped exception messages in error pages). The target version (Jetty 10.0.33.tuxcare0001) does not contain the vulnerable code pattern. The upstream fix (commits 9e40fc9a6fb and cf0df6e3ffd by Joakim Erdfelt) was already included in Jetty 10.0.0, the first stable 10.x release. TuxCare onboarded Jetty 10.0.26, which already contained this upstre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. Target Jetty 10.0.33 is not affected by CVE-2019-17638 (double-release of ByteBuffer during header overflow leading to data leakage between clients). The vulnerability was fixed in upstream commit ff8ae56fa93 by Greg Wilkins (gregw@webtide.com) on June 3, 2020. This fix was already present in Jetty 10.0.26 when TuxCare onboarded the code (first TuxCare commit e2a9c9de56a - \"setup 10.0.26\"). The target contains the complete defense: releaseHeader() and releaseChunk() methods that both release and null buffer references, preventing double-release. The HEADER_OVERFLOW case properly calls releaseHeader() before throwing exceptions, ensuring buffers cannot be released twice.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "Target Jetty 10.0.33 is not affected by CVE-2019-17638 (double-release of ByteBuffer during header overflow leading to data leakage between clients). The vulnerability was fixed in upstream commit ff8ae56fa93 by Greg Wilkins (gregw@webtide.com) on June 3, 2020. This fix was already present in Jetty 10.0.26 when TuxCare onboarded the code (first TuxCare commit e2a9c9de56a - \"setup 10.0.26\"). The target contains the complete defense: releaseHeader() and releaseChunk() methods that both release and null buffer references, preventing double-release. The HEADER_OVERFLOW case properly calls releaseHeader() before throwing exceptions, ensuring buffers cannot be released twice.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:36:34.527535+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 affects Jetty when GZIP request body inflation is enabled and allows attackers to inject data into subsequent requests via unconsumed request bodies on persistent connections. The target (Jetty 10.0.33.tuxcare0001) is NOT AFFECTED because the vulnerability was fixed by upstream maintainer Greg Wilkins in commit 14f94f738df (November 18, 2020), which shipped in Jetty 10.0.0. TuxCa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 affects Jetty when GZIP request body inflation is enabled and allows attackers to inject data into subsequent requests via unconsumed request bodies on persistent connections. The target (Jetty 10.0.33.tuxcare0001) is NOT AFFECTED because the vulnerability was fixed by upstream maintainer Greg Wilkins in commit 14f94f738df (November 18, 2020), which shipped in Jetty 10.0.0. TuxCa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:30:16.565397+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 10.0.33.tuxcare0001) is not affected by CVE-2020-27223. The vulnerable quadratic-complexity sorting algorithm in QuotedQualityCSV has been replaced with an efficient O(n log n) comparator-based sort. The fix was authored by upstream developer Joakim Erdfelt and was already present in the upstream release (Jetty 10.0.x) when TuxCare onboarded version 10.0.26. The CVE...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 10.0.33.tuxcare0001) is not affected by CVE-2020-27223. The vulnerable quadratic-complexity sorting algorithm in QuotedQualityCSV has been replaced with an efficient O(n log n) comparator-based sort. The fix was authored by upstream developer Joakim Erdfelt and was already present in the upstream release (Jetty 10.0.x) when TuxCare onboarded version 10.0.26. The CVE..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:31:15.270922+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. The target jetty.project 10.0.33 is NOT AFFECTED by CVE-2021-28165. The vulnerability (CPU exhaustion from malformed TLS frames >17408 bytes) has been fixed by upstream commit 039c7386d0f authored by Simone Bordet. This fix was already present in the upstream 10.0.26 release that TuxCare onboarded, before any TuxCare modifications. The defense code at SslConnection.java:756-760 detects when the encrypted input buffer is full during a BUFFER_UNDERFLOW condition and throws SSLHandshakeException to prevent infinite processing loops.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "The target jetty.project 10.0.33 is NOT AFFECTED by CVE-2021-28165. The vulnerability (CPU exhaustion from malformed TLS frames >17408 bytes) has been fixed by upstream commit 039c7386d0f authored by Simone Bordet. This fix was already present in the upstream 10.0.26 release that TuxCare onboarded, before any TuxCare modifications. The defense code at SslConnection.java:756-760 detects when the encrypted input buffer is full during a BUFFER_UNDERFLOW condition and throws SSLHandshakeException to prevent infinite processing loops.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T21:10:30.464414+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 10.0.30 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "Version 10.0.30 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2022-2191 (ByteBuffer leak in SslConnection error paths) is NOT present in Jetty 10.0.33. The fix was already included in upstream Jetty 10.0.10 (released June 2022) and was present in the upstream release 10.0.26 that TuxCare onboarded. The target version 10.0.33 contains the complete fix with proper buffer cleanup in exception handlers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "CVE-2022-2191 (ByteBuffer leak in SslConnection error paths) is NOT present in Jetty 10.0.33. The fix was already included in upstream Jetty 10.0.10 (released June 2022) and was present in the upstream release 10.0.26 that TuxCare onboarded. The target version 10.0.33 contains the complete fix with proper buffer cleanup in exception handlers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:47:00.089939+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26048 concerns multipart request OOM vulnerabilities in Jetty. The target version 10.0.33.tuxcare0001 contains the upstream fix (commit 622befbd0d5, merged 2023-02-14) that adds two defenses: (1) limits the number of multipart parts via _maxParts field, and (2) limits cumulative size of non-file parts via formContentSize validation with Math.addExact. This fix was authored by upstream ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26048 concerns multipart request OOM vulnerabilities in Jetty. The target version 10.0.33.tuxcare0001 contains the upstream fix (commit 622befbd0d5, merged 2023-02-14) that adds two defenses: (1) limits the number of multipart parts via _maxParts field, and (2) limits cumulative size of non-file parts via formContentSize validation with Math.addExact. This fix was authored by upstream ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:16:00.096279+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 10.0.33 is NOT AFFECTED by CVE-2023-26049 (cookie smuggling via quoted values containing semicolons). The upstream fix commit 7b8c2c1bf08 was already present in Jetty 10.0.26 when TuxCare onboarded it. The fix adds validation to reject semicolons and special characters in quoted cookie values, preventing the parser from treating a quoted string spanning multiple cookie boundaries...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 Target version 10.0.33 is NOT AFFECTED by CVE-2023-26049 (cookie smuggling via quoted values containing semicolons). The upstream fix commit 7b8c2c1bf08 was already present in Jetty 10.0.26 when TuxCare onboarded it. The fix adds validation to reject semicolons and special characters in quoted cookie values, preventing the parser from treating a quoted string spanning multiple cookie boundaries..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2024-13009: The target (Jetty 10.0.33.tuxcare0001) is NOT AFFECTED. The upstream fix commit e3fa9466633db6bf36e0eb0d17e3de166c788ede was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded on 2026-09-24. The fix ensures that when gzip decompression fails, content buffer references are immediately nulled to prevent buffer reuse between requests. The fix logic is present in AsyncContentProducer.failCurrentContent() which nulls both _transformedContent and _rawContent when errors occur. Since this is an upstream fix (author gregw@webtide.com) that shipped before TuxCare's onboarding, the vulnerable code pattern was never present in the TuxCare branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "CVE-2024-13009: The target (Jetty 10.0.33.tuxcare0001) is NOT AFFECTED. The upstream fix commit e3fa9466633db6bf36e0eb0d17e3de166c788ede was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded on 2026-09-24. The fix ensures that when gzip decompression fails, content buffer references are immediately nulled to prevent buffer reuse between requests. The fix logic is present in AsyncContentProducer.failCurrentContent() which nulls both _transformedContent and _rawContent when errors occur. Since this is an upstream fix (author gregw@webtide.com) that shipped before TuxCare's onboarding, the vulnerable code pattern was never present in the TuxCare branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2024-7708 affects Jetty 10.0.0-10.0.22 with a memory leak vulnerability when reading HTTP request bodies returns 0 bytes (particularly with 100-Continue requests). The target repository at version 10.0.33.tuxcare0001 is NOT AFFECTED because the upstream fix (commit 8259eabbc70ae7fc2d525f1e95b43fbdfd2ad097 by Simone Bordet, dated 2024-08-14) was already included in the upstream release before TuxCare onboarded version 10.0.26. The vulnerable code pattern does not exist in the target - both fix elements are present: (1) releaseRequestBuffer() call when filled <= 0, and (2) buffer cleanup in exception handler. This is an upstream fix that shipped with the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "CVE-2024-7708 affects Jetty 10.0.0-10.0.22 with a memory leak vulnerability when reading HTTP request bodies returns 0 bytes (particularly with 100-Continue requests). The target repository at version 10.0.33.tuxcare0001 is NOT AFFECTED because the upstream fix (commit 8259eabbc70ae7fc2d525f1e95b43fbdfd2ad097 by Simone Bordet, dated 2024-08-14) was already included in the upstream release before TuxCare onboarded version 10.0.26. The vulnerable code pattern does not exist in the target - both fix elements are present: (1) releaseRequestBuffer() call when filled <= 0, and (2) buffer cleanup in exception handler. This is an upstream fix that shipped with the base release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T21:10:30.464414+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T21:10:30.464414+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 10.0.30 is not affected by CVE-2026-10051. The CVE targets Jetty 12+ jetty-core architecture (jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/HttpConnection.java), which does not exist in Jetty 10. While Jetty 10 uses a different architecture (HttpChannelOverHttp.java) that processes HTTP trailers, it has an effective defense: the _trailers field is nulled in the r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 10.0.30 is not affected by CVE-2026-10051. The CVE targets Jetty 12+ jetty-core architecture (jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/HttpConnection.java), which does not exist in Jetty 10. While Jetty 10 uses a different architecture (HttpChannelOverHttp.java) that processes HTTP trailers, it has an effective defense: the _trailers field is nulled in the r..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T21:10:30.464414+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T21:10:30.464414+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T22:44:40.243946+00:00",
      "status_notes": "Vulnerability CVE-2026-18660 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-18660"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T21:10:30.464414+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T21:10:30.464414+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T21:10:30.464414+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T22:44:40.243946+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T22:44:40.243946+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T22:44:40.243946+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 10.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    }
  ]
}