{
  "@id": "urn:uuid:6d9463e9-0b9a-4206-a76e-856f802d2135",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:29:48.390816+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:09:27.722120+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 describes predictable session ID generation in Jetty due to use of java.util.Random instead of cryptographically secure random number generation. Analysis of Jetty 10.0.34.tuxcare0001 shows the vulnerable pattern is NOT present. The DefaultSessionIdManager.initRandom() method (lines 353-370) uses java.security.SecureRandom by default (line 359), with fallback to java.util.Random o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 describes predictable session ID generation in Jetty due to use of java.util.Random instead of cryptographically secure random number generation. Analysis of Jetty 10.0.34.tuxcare0001 shows the vulnerable pattern is NOT present. The DefaultSessionIdManager.initRandom() method (lines 353-370) uses java.security.SecureRandom by default (line 359), with fallback to java.util.Random o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 (hash collision DoS via unlimited form parameters) is NOT present in Jetty 10.0.34. The fix limiting form parameter keys to prevent hash collision attacks was committed upstream by Greg Wilkins in December 2011 (commit 085c79d7d6c) and was already present in the Jetty 10.0.26 release that TuxCare onboarded. The target implements the maxFormKeys defense (default 1000) in ContextHan...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-4461 (hash collision DoS via unlimited form parameters) is NOT present in Jetty 10.0.34. The fix limiting form parameter keys to prevent hash collision attacks was committed upstream by Greg Wilkins in December 2011 (commit 085c79d7d6c) and was already present in the Jetty 10.0.26 release that TuxCare onboarded. The target implements the maxFormKeys defense (default 1000) in ContextHan..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 affects version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "action_statement": "Vulnerability CVE-2015-2080 affects version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:31:44.936589+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9, involving a path normalization vulnerability in PathResource that allowed bypassing protected resource restrictions on Windows via URLs with escaped backslashes. The target repository (Jetty 10.0.34.tuxcare0001) contains the upstream fix (commit 97af3d663fd, authored by Joakim Erdfelt on 2016-05-13), which was already present in the upstre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9, involving a path normalization vulnerability in PathResource that allowed bypassing protected resource restrictions on Windows via URLs with escaped backslashes. The target repository (Jetty 10.0.34.tuxcare0001) contains the upstream fix (commit 97af3d663fd, authored by Joakim Erdfelt on 2016-05-13), which was already present in the upstre..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 affects version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "action_statement": "Vulnerability CVE-2017-7656 affects version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 affects version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "action_statement": "Vulnerability CVE-2017-7658 affects version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T18:21:46.779429+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 042f325f, 2baa1abe, f3751d70). Version 10.0.34 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wfcc-pff6-rgc5 (affected up to 9.4.6.v20170531), NVD (affected up to 9.4.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 042f325f, 2baa1abe, f3751d70). Version 10.0.34 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wfcc-pff6-rgc5 (affected up to 9.4.6.v20170531), NVD (affected up to 9.4.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T10:41:28.069303+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 10.0.34 already contains the upstream fix for CVE-2018-12536. Errors from filesystem path construction during static file serving are wrapped or caught, so the base-directory path never reaches the error response. The fix shipped in the upstream release that TuxCare onboarded, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 Jetty 10.0.34 already contains the upstream fix for CVE-2018-12536. Errors from filesystem path construction during static file serving are wrapped or caught, so the base-directory path never reaches the error response. The fix shipped in the upstream release that TuxCare onboarded, so the verdict is not_affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. Target Jetty 10.0.34.tuxcare0001 is not affected by CVE-2018-12545. The vulnerability (unlimited SETTINGS key processing leading to resource exhaustion) was fixed by upstream Jetty in commit 9eca404da29 (issue #2722, maxSettingsKeys limit) and cfe1baa0482 (issue #3978, rate control framework). Both fixes were already present in the upstream Jetty 10.0.26 release that TuxCare onboarded, making the vulnerable pattern absent from the target. The defenses limit SETTINGS keys to 64 per frame and apply rate control to frame processing, preventing the DoS condition described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "Target Jetty 10.0.34.tuxcare0001 is not affected by CVE-2018-12545. The vulnerability (unlimited SETTINGS key processing leading to resource exhaustion) was fixed by upstream Jetty in commit 9eca404da29 (issue #2722, maxSettingsKeys limit) and cfe1baa0482 (issue #3978, rate control framework). Both fixes were already present in the upstream Jetty 10.0.26 release that TuxCare onboarded, making the vulnerable pattern absent from the target. The defenses limit SETTINGS keys to 64 per frame and apply rate control to frame processing, preventing the DoS condition described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T07:19:00.126490+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty 10.0.34 is not affected by CVE-2019-10241. Resource.getListHTML already escapes the URL-derived path and the entry names before putting them in the HTML. The upstream fix (commit 59a80ea0179, \"XSS in directory listing\", author greg@webtide.com) is in the upstream release that TuxCare onboarded. The first TuxCare commit in HEAD's history is f1ccbc08a63 (\"setup 10.0.26\"), and the fix...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 10.0.34 is not affected by CVE-2019-10241. Resource.getListHTML already escapes the URL-derived path and the entry names before putting them in the HTML. The upstream fix (commit 59a80ea0179, \"XSS in directory listing\", author greg@webtide.com) is in the upstream release that TuxCare onboarded. The first TuxCare commit in HEAD's history is f1ccbc08a63 (\"setup 10.0.26\"), and the fix..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 is not present in target Jetty 10.0.34.tuxcare0001. The vulnerability (Windows path disclosure in directory listings) was fixed in upstream commit 7b774d82e82 (April 2019) which replaced vulnerable getName() usage with a safe getFileName() method. This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded, before any TuxCare modifications. The vulne...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 is not present in target Jetty 10.0.34.tuxcare0001. The vulnerability (Windows path disclosure in directory listings) was fixed in upstream commit 7b774d82e82 (April 2019) which replaced vulnerable getName() usage with a safe getFileName() method. This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded, before any TuxCare modifications. The vulne..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T07:20:00.085500+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target 10.0.34 is not vulnerable to CVE-2019-10247. DefaultHandler's 404 context listing no longer prints the base resource or filesystem path. The upstream fix for Jetty issue #3555 (commits 04c99471, 9f506e41, a15534d7) is an ancestor of HEAD and was already in the upstream release TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 Target 10.0.34 is not vulnerable to CVE-2019-10247. DefaultHandler's 404 context listing no longer prints the base resource or filesystem path. The upstream fix for Jetty issue #3555 (commits 04c99471, 9f506e41, a15534d7) is an ancestor of HEAD and was already in the upstream release TuxCare onboarded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:19:00.599819+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 affects Jetty versions 9.4.21-9.4.23 where exception messages in error responses (HTML/JSON) were not escaped, enabling potential XSS attacks. The target (Jetty 10.0.34.tuxcare0001) is not affected because the upstream vendor fix was already included in the release that TuxCare onboarded. The fix adds sanitization via StringUtil.sanitizeXmlString() to all exception messages and s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 affects Jetty versions 9.4.21-9.4.23 where exception messages in error responses (HTML/JSON) were not escaped, enabling potential XSS attacks. The target (Jetty 10.0.34.tuxcare0001) is not affected because the upstream vendor fix was already included in the release that TuxCare onboarded. The fix adds sanitization via StringUtil.sanitizeXmlString() to all exception messages and s..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. The target Jetty 10.0.34 repository is not affected by CVE-2019-17638. The vulnerability (double-release of ByteBuffer causing information disclosure) was fixed in upstream commit ff8ae56fa93 by Greg Wilkins on June 3, 2020. This fix was already present in Jetty 10.0.0 and all subsequent releases, including version 10.0.26 which was the first TuxCare onboarded version. The fix includes: (1) moving _chunk field from class-level to SendCallback instance scope, (2) adding releaseHeader() and releaseChunk() methods with proper null-checking, (3) ensuring single-release semantics in HEADER_OVERFLOW and NEED_CHUNK_TRAILER cases, and (4) consolidated cleanup in release() method. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "The target Jetty 10.0.34 repository is not affected by CVE-2019-17638. The vulnerability (double-release of ByteBuffer causing information disclosure) was fixed in upstream commit ff8ae56fa93 by Greg Wilkins on June 3, 2020. This fix was already present in Jetty 10.0.0 and all subsequent releases, including version 10.0.26 which was the first TuxCare onboarded version. The fix includes: (1) moving _chunk field from class-level to SendCallback instance scope, (2) adding releaseHeader() and releaseChunk() methods with proper null-checking, (3) ensuring single-release semantics in HEADER_OVERFLOW and NEED_CHUNK_TRAILER cases, and (4) consolidated cleanup in release() method. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:38:30.667641+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (jetty-project 10.0.34.tuxcare0001) is not affected by CVE-2020-27218. The vulnerability, which allows unconsumed GZIP-inflated request body data to leak into subsequent requests on multiplexed connections, was fixed in upstream commit 14f94f738df (Issue #5605) by Greg Wilkins. This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded, makin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 The target repository (jetty-project 10.0.34.tuxcare0001) is not affected by CVE-2020-27218. The vulnerability, which allows unconsumed GZIP-inflated request body data to leak into subsequent requests on multiplexed connections, was fixed in upstream commit 14f94f738df (Issue #5605) by Greg Wilkins. This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded, makin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:30:41.513971+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 10.0.34 is not affected by CVE-2020-27223. The vulnerable O(n\u00b2) bubble-sort-like algorithm in QuotedQualityCSV.sort() has been replaced with an efficient O(n log n) stream-based comparator sort. This fix was applied in upstream commit 10e531756b972162eed402c44d0244f7f6b85131 (authored by Joakim Erdfelt) and was already present in the upstream Jetty 10.0.26 release before TuxCar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 10.0.34 is not affected by CVE-2020-27223. The vulnerable O(n\u00b2) bubble-sort-like algorithm in QuotedQualityCSV.sort() has been replaced with an efficient O(n log n) stream-based comparator sort. This fix was applied in upstream commit 10e531756b972162eed402c44d0244f7f6b85131 (authored by Joakim Erdfelt) and was already present in the upstream Jetty 10.0.26 release before TuxCar..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 affects version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "action_statement": "Vulnerability CVE-2021-28165 affects version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 10.0.30 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "Version 10.0.30 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. The target repository (jetty-project 10.0.34.tuxcare0001) is NOT affected by CVE-2022-2191. The vulnerability pattern (ByteBuffer resource leaks in SslConnection error paths) was fixed by upstream commit 66de7ba6180 authored by Ludovic Orban on June 15, 2022. This fix was already present in the upstream Jetty release before TuxCare began maintaining this branch (first TuxCare commit: f1ccbc08a63 \"setup 10.0.26\"). Code verification confirms all defensive methods (discardInputBuffers, discardEncryptedOutputBuffer) are present and correctly invoked in error handling paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "The target repository (jetty-project 10.0.34.tuxcare0001) is NOT affected by CVE-2022-2191. The vulnerability pattern (ByteBuffer resource leaks in SslConnection error paths) was fixed by upstream commit 66de7ba6180 authored by Ludovic Orban on June 15, 2022. This fix was already present in the upstream Jetty release before TuxCare began maintaining this branch (first TuxCare commit: f1ccbc08a63 \"setup 10.0.26\"). Code verification confirms all defensive methods (discardInputBuffers, discardEncryptedOutputBuffer) are present and correctly invoked in error handling paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T07:28:00.058471+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 10.0.34.tuxcare0001 already contains the upstream fix for CVE-2023-26048 (PR #9344): a max-parts limit in MultiPartFormInputStream and a cumulative maxFormContentSize check on non-file parts in Request.getParts. The fix was in the upstream release that TuxCare onboarded, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 Jetty 10.0.34.tuxcare0001 already contains the upstream fix for CVE-2023-26048 (PR #9344): a max-parts limit in MultiPartFormInputStream and a cumulative maxFormContentSize check on non-file parts in Request.getParts. The fix was in the upstream release that TuxCare onboarded, so the verdict is not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T07:27:00.031105+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty 10.0.34 already contains the upstream fix for CVE-2023-26049 (PR #9339, commit 7b8c2c1bf08, in 10.0.15). That fix is part of the upstream release TuxCare onboarded. Under the default RFC6265 compliance mode, a quoted cookie value containing ';' is no longer split off and returned as part of another cookie's value. The cookie is flagged invalid and dropped whole.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 10.0.34 already contains the upstream fix for CVE-2023-26049 (PR #9339, commit 7b8c2c1bf08, in 10.0.15). That fix is part of the upstream release TuxCare onboarded. Under the default RFC6265 compliance mode, a quoted cookie value containing ';' is no longer split off and returned as part of another cookie's value. The cookie is flagged invalid and dropped whole."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. Jetty 10.0.34 is not affected by CVE-2024-13009. The vulnerability exists in Jetty 9.4.x which uses a different HttpInput architecture. Jetty 10.x was refactored in 2020 to use a ContentProducer pattern that inherently prevents buffer reuse on gzip decompression failures. The AsyncContentProducer.failCurrentContent() method (introduced in commit 814dc69803f6 from 2020-03-20) nulls out content references after failures, providing the same protection that the CVE-2024-13009 fix adds to 9.4.x. This architectural change was present in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "Jetty 10.0.34 is not affected by CVE-2024-13009. The vulnerability exists in Jetty 9.4.x which uses a different HttpInput architecture. Jetty 10.x was refactored in 2020 to use a ContentProducer pattern that inherently prevents buffer reuse on gzip decompression failures. The AsyncContentProducer.failCurrentContent() method (introduced in commit 814dc69803f6 from 2020-03-20) nulls out content references after failures, providing the same protection that the CVE-2024-13009 fix adds to 9.4.x. This architectural change was present in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2024-7708 (memory leak in HttpConnection when reading 0 bytes) is NOT present in Jetty 10.0.34.tuxcare0001. The fix (commit 8259eabbc70) was authored by upstream developer Simone Bordet and shipped in Jetty 10.0.23. TuxCare onboarded version 10.0.26, which already included this fix. The target code at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:381-386 and 393-403 correctly calls releaseRequestBuffer() when fill() returns \u22640 bytes and in exception handlers, preventing buffer leaks. Verdict: not_affected because the vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "CVE-2024-7708 (memory leak in HttpConnection when reading 0 bytes) is NOT present in Jetty 10.0.34.tuxcare0001. The fix (commit 8259eabbc70) was authored by upstream developer Simone Bordet and shipped in Jetty 10.0.23. TuxCare onboarded version 10.0.26, which already included this fix. The target code at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:381-386 and 393-403 correctly calls releaseRequestBuffer() when fill() returns \u22640 bytes and in exception handlers, preventing buffer leaks. Verdict: not_affected because the vulnerable code pattern never existed in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 10.0.30 is not affected by CVE-2026-10051. The CVE targets Jetty 12+ jetty-core architecture (jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/HttpConnection.java), which does not exist in Jetty 10. While Jetty 10 uses a different architecture (HttpChannelOverHttp.java) that processes HTTP trailers, it has an effective defense: the _trailers field is nulled in the r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 10.0.30 is not affected by CVE-2026-10051. The CVE targets Jetty 12+ jetty-core architecture (jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/HttpConnection.java), which does not exist in Jetty 10. While Jetty 10 uses a different architecture (HttpChannelOverHttp.java) that processes HTTP trailers, it has an effective defense: the _trailers field is nulled in the r..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-18660 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-18660"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:55:00.224632+00:00",
      "status_notes": "Vulnerability CVE-2026-95533 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-95533"
      }
    }
  ]
}