{ "@id": "urn:uuid:0eba7ba4-ee1c-4cb5-9eb3-6e2bb7129f6a", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-09T19:06:59.961936+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2006-6969 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 affects Jetty versions that used java.util.Random (a predictable PRNG) for session ID generation by default. The target (Jetty 11.0.18) is not affected because upstream fixed this vulnerability in 2010 (commit c3275730b91, JETTY-1202) by changing DefaultSessionIdManager to use java.security.SecureRandom by default. The vulnerable code pattern (defaulting to weak random) is no long...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2006-6969" }, "impact_statement": "not_affected \u2014 CVE-2006-6969 affects Jetty versions that used java.util.Random (a predictable PRNG) for session ID generation by default. The target (Jetty 11.0.18) is not affected because upstream fixed this vulnerability in 2010 (commit c3275730b91, JETTY-1202) by changing DefaultSessionIdManager to use java.security.SecureRandom by default. The vulnerable code pattern (defaulting to weak random) is no long..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2011-4461 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 11.0.18 is not affected by CVE-2011-4461 (hash collision DoS in form parameters). The fix limiting form parameter keys to a maximum of 1000 (configurable via maxFormKeys) was introduced in upstream commit 085c79d7d6c by Greg Wilkins on 2011-12-30. This fix was already present in the upstream Jetty 11.0.18 release that TuxCare onboarded on 2026-09-12. The defense is active by de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-4461" }, "impact_statement": "not_affected \u2014 The target Jetty 11.0.18 is not affected by CVE-2011-4461 (hash collision DoS in form parameters). The fix limiting form parameter keys to a maximum of 1000 (configurable via maxFormKeys) was introduced in upstream commit 085c79d7d6c by Greg Wilkins on 2011-12-30. This fix was already present in the upstream Jetty 11.0.18 release that TuxCare onboarded on 2026-09-12. The defense is active by de..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2015-2080 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.18 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-2080" }, "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.18 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2016-4800 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Jetty 9.3.0 through 9.3.8 and was fixed in Jetty 9.3.9 (May 2016, commit 97af3d663fd). The target is Jetty 11.0.18, which is 7 major versions ahead and contains the upstream fix. The vulnerability involved Windows path normalization issues where backslashes in URLs could bypass protected resource restrictions. The fix preserves the original URI before Windows normalizes it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4800" }, "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Jetty 9.3.0 through 9.3.8 and was fixed in Jetty 9.3.9 (May 2016, commit 97af3d663fd). The target is Jetty 11.0.18, which is 7 major versions ahead and contains the upstream fix. The vulnerability involved Windows path normalization issues where backslashes in URLs could bypass protected resource restrictions. The fix preserves the original URI before Windows normalizes it..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2017-7656 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2017-7656 (HTTP Request Smuggling) is NOT present in Jetty 11.0.18. The target contains comprehensive defenses against ambiguous message framing: (1) rejection of multiple Content-Length headers via MULTIPLE_CONTENT_LENGTHS violation check, (2) rejection of simultaneous Content-Length + Transfer-Encoding: chunked via TRANSFER_ENCODING_WITH_CONTENT_LENGTH check, (3) chunk length overflow protection, all enforced by default in RFC7230 compliance mode. The fix was introduced by upstream commit a285deea (author: gregw@webtide.com, 2018-05-17) and was already present in the Jetty 11.0.18 release that TuxCare onboarded on 2024-11-13. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7656" }, "impact_statement": "CVE-2017-7656 (HTTP Request Smuggling) is NOT present in Jetty 11.0.18. The target contains comprehensive defenses against ambiguous message framing: (1) rejection of multiple Content-Length headers via MULTIPLE_CONTENT_LENGTHS violation check, (2) rejection of simultaneous Content-Length + Transfer-Encoding: chunked via TRANSFER_ENCODING_WITH_CONTENT_LENGTH check, (3) chunk length overflow protection, all enforced by default in RFC7230 compliance mode. The fix was introduced by upstream commit a285deea (author: gregw@webtide.com, 2018-05-17) and was already present in the Jetty 11.0.18 release that TuxCare onboarded on 2024-11-13. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2017-7657 affects version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-7657" }, "action_statement": "Vulnerability CVE-2017-7657 affects version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2017-7658 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. The target (Jetty 11.0.18) is NOT vulnerable to CVE-2017-7658 (HTTP Request Smuggling). The upstream fix (commit a285deea42f by gregw@webtide.com, dated 2018-05-17) was already present in the Jetty 11.0.18 release that TuxCare onboarded. The HttpParser now rejects HTTP requests containing either multiple Content-Length headers or both Content-Length and Transfer-Encoding headers, preventing the message boundary confusion that enables request smuggling. The defense is active by default under RFC7230 compliance mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7658" }, "impact_statement": "The target (Jetty 11.0.18) is NOT vulnerable to CVE-2017-7658 (HTTP Request Smuggling). The upstream fix (commit a285deea42f by gregw@webtide.com, dated 2018-05-17) was already present in the Jetty 11.0.18 release that TuxCare onboarded. The HttpParser now rejects HTTP requests containing either multiple Content-Length headers or both Content-Length and Transfer-Encoding headers, preventing the message boundary confusion that enables request smuggling. The defense is active by default under RFC7230 compliance mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2017-9735 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2017-9735 timing attack vulnerability is NOT present in target Jetty 11.0.18. The vulnerable variable-time password comparison code was replaced with constant-time comparison methods (stringEquals, byteEquals) by upstream Jetty developer Lachlan Roberts in commit e727ad893d2 (Oct 2018). This fix was already included in the upstream Jetty 11.0.18 release when TuxCare onboarded it, predating the first TuxCare commit by 10,604 commits. All password/credential comparison code paths (Password.check, Credential.MD5.check, Credential.Crypt.check, DigestAuthenticator.Digest.check) use constant-time comparison, preventing timing-based information disclosure about password content.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-9735" }, "impact_statement": "CVE-2017-9735 timing attack vulnerability is NOT present in target Jetty 11.0.18. The vulnerable variable-time password comparison code was replaced with constant-time comparison methods (stringEquals, byteEquals) by upstream Jetty developer Lachlan Roberts in commit e727ad893d2 (Oct 2018). This fix was already included in the upstream Jetty 11.0.18 release when TuxCare onboarded it, predating the first TuxCare commit by 10,604 commits. All password/credential comparison code paths (Password.check, Credential.MD5.check, Credential.Crypt.check, DigestAuthenticator.Digest.check) use constant-time comparison, preventing timing-based information disclosure about password content.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 is not present in Jetty 11.0.18. The vulnerability (path disclosure via InvalidPathException in error responses) was fixed in upstream Jetty by commit ad4dceb1c08 in May 2018. This fix was already included in the upstream Jetty 11.0.18 release (October 2023) that TuxCare onboarded. The defense code in ResourceContentFactory.getContent() wraps all exceptions with sanitized Invalid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12536" }, "impact_statement": "not_affected \u2014 CVE-2018-12536 is not present in Jetty 11.0.18. The vulnerability (path disclosure via InvalidPathException in error responses) was fixed in upstream Jetty by commit ad4dceb1c08 in May 2018. This fix was already included in the upstream Jetty 11.0.18 release (October 2023) that TuxCare onboarded. The defense code in ResourceContentFactory.getContent() wraps all exceptions with sanitized Invalid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2018-12538 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. Prechecker: the upstream fix is already in this version's git history (commit a0b8321e). Advisories: GitHub, NVD and Snyk end the affected lines at 9.4.8 to 9.4.11, and this version is on a newer line; the cve.org (Eclipse) record reads as affected only because its range has no upper end.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12538" }, "impact_statement": "Prechecker: the upstream fix is already in this version's git history (commit a0b8321e). Advisories: GitHub, NVD and Snyk end the affected lines at 9.4.8 to 9.4.11, and this version is on a newer line; the cve.org (Eclipse) record reads as affected only because its range has no upper end." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2018-12545 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2018-12545 (HTTP/2 SETTINGS frame DoS) is NOT present in target Jetty 11.0.18. Both required defenses (maxSettingsKeys limit and RateControl mechanism) were already shipped in upstream Jetty 11.0.18 before TuxCare onboarded it. The fixes were authored by upstream Jetty developers (simone.bordet@gmail.com, gregw@webtide.com) in commits 9eca404da29 (issue #2722, Jetty 9.4.11) and cfe1baa0482 (issue #3978, Jetty 9.4.19). TuxCare's first commit 68f02af5af3 \"Onboard version 11.0.18\" included these fixes from the upstream release. Verdict: not_affected (upstream fix).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12545" }, "impact_statement": "CVE-2018-12545 (HTTP/2 SETTINGS frame DoS) is NOT present in target Jetty 11.0.18. Both required defenses (maxSettingsKeys limit and RateControl mechanism) were already shipped in upstream Jetty 11.0.18 before TuxCare onboarded it. The fixes were authored by upstream Jetty developers (simone.bordet@gmail.com, gregw@webtide.com) in commits 9eca404da29 (issue #2722, Jetty 9.4.11) and cfe1baa0482 (issue #3978, Jetty 9.4.19). TuxCare's first commit 68f02af5af3 \"Onboard version 11.0.18\" included these fixes from the upstream release. Verdict: not_affected (upstream fix).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.18) is NOT affected by CVE-2019-10241. The vulnerability fix was already present in the upstream Jetty release when TuxCare onboarded version 11.0.18. The fix (commit 3d028ab2ca7 from April 2019) was implemented by upstream Jetty maintainer Joakim Erdfelt and shipped in the base release, meaning the vulnerable code pattern (exposing full filesystem paths and un...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10241" }, "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.18) is NOT affected by CVE-2019-10241. The vulnerability fix was already present in the upstream Jetty release when TuxCare onboarded version 11.0.18. The fix (commit 3d028ab2ca7 from April 2019) was implemented by upstream Jetty maintainer Joakim Erdfelt and shipped in the base release, meaning the vulnerable code pattern (exposing full filesystem paths and un..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2019-10246 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 is not present in this target. The vulnerability involved directory listings on Windows exposing fully qualified filesystem paths. The upstream Eclipse Jetty project fixed this in April 2019 by adding a getFileName() method that uses OS-aware File.getName() to extract only the filename component. This fix (commit 1565b5f160e by joakim.erdfelt@gmail.com) was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10246" }, "impact_statement": "not_affected \u2014 CVE-2019-10246 is not present in this target. The vulnerability involved directory listings on Windows exposing fully qualified filesystem paths. The upstream Eclipse Jetty project fixed this in April 2019 by adding a getFileName() method that uses OS-aware File.getName() to extract only the filename component. This fix (commit 1565b5f160e by joakim.erdfelt@gmail.com) was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 11.0.18 is not affected by CVE-2019-10247. The vulnerability involved DefaultHandler's 404 error page disclosing filesystem directory paths via context.toString() output. The upstream fix (commit 04c994712c0) was already included in the jetty-11.0.18 release that TuxCare onboarded. The target's DefaultHandler.java does not contain the vulnerable code pattern - it never calls cont...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10247" }, "impact_statement": "not_affected \u2014 Target version 11.0.18 is not affected by CVE-2019-10247. The vulnerability involved DefaultHandler's 404 error page disclosing filesystem directory paths via context.toString() output. The upstream fix (commit 04c994712c0) was already included in the jetty-11.0.18 release that TuxCare onboarded. The target's DefaultHandler.java does not contain the vulnerable code pattern - it never calls cont..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2019-17632 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 affects Eclipse Jetty 9.4.21-9.4.23 (XSS via unescaped exception messages in error responses). The target is Jetty 11.0.18, which already contains the upstream fix commits (9e40fc9a6fb and cf0df6e3ffd) that add HTML entity encoding via StringUtil.sanitizeXmlString() to both text/html and text/json error outputs. These fixes were authored by upstream maintainer Joakim Erdfelt and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17632" }, "impact_statement": "not_affected \u2014 CVE-2019-17632 affects Eclipse Jetty 9.4.21-9.4.23 (XSS via unescaped exception messages in error responses). The target is Jetty 11.0.18, which already contains the upstream fix commits (9e40fc9a6fb and cf0df6e3ffd) that add HTML entity encoding via StringUtil.sanitizeXmlString() to both text/html and text/json error outputs. These fixes were authored by upstream maintainer Joakim Erdfelt and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2019-17638 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. Target Jetty 11.0.18 is not affected by CVE-2019-17638. The vulnerable code pattern (double-release of ByteBuffer causing cross-client data leakage) is not present because the upstream fix was already included in Jetty 11.0.18 before TuxCare onboarded it. The fix (commit ff8ae56fa93 by gregw@webtide.com) introduced releaseHeader() and releaseChunk() methods that properly null buffer references after release, preventing the double-release bug. This fix was already in the upstream release when TuxCare onboarded version 11.0.18 (first TuxCare commit: 68f02af5af3).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17638" }, "impact_statement": "Target Jetty 11.0.18 is not affected by CVE-2019-17638. The vulnerable code pattern (double-release of ByteBuffer causing cross-client data leakage) is not present because the upstream fix was already included in Jetty 11.0.18 before TuxCare onboarded it. The fix (commit ff8ae56fa93 by gregw@webtide.com) introduced releaseHeader() and releaseChunk() methods that properly null buffer references after release, preventing the double-release bug. This fix was already in the upstream release when TuxCare onboarded version 11.0.18 (first TuxCare commit: 68f02af5af3).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2020-27218 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 is NOT present in Jetty 11.0.18. The vulnerability (unconsumed GZIP request body data persisting across requests on the same connection) has been fixed by upstream commit 14f94f738df5adf68549749d01d4f9d97ea51452 authored by Greg Wilkins on 2020-11-18. The fix was already present in the upstream Jetty 11.0.18 release before TuxCare onboarded it. The defense mechanism properly cons...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27218" }, "impact_statement": "not_affected \u2014 CVE-2020-27218 is NOT present in Jetty 11.0.18. The vulnerability (unconsumed GZIP request body data persisting across requests on the same connection) has been fixed by upstream commit 14f94f738df5adf68549749d01d4f9d97ea51452 authored by Greg Wilkins on 2020-11-18. The fix was already present in the upstream Jetty 11.0.18 release before TuxCare onboarded it. The defense mechanism properly cons..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2020-27223 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target (Jetty 11.0.18) is NOT AFFECTED by CVE-2020-27223. The vulnerable quadratic-time sorting algorithm in QuotedQualityCSV has been replaced with an efficient O(n log n) Comparator-based sort. This fix was applied by upstream vendor (Eclipse Jetty) in commit 10e531756b972162eed402c44d0244f7f6b85131 and was already included in upstream release 11.0.1, before TuxCare onboarded version 11.0...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27223" }, "impact_statement": "not_affected \u2014 The target (Jetty 11.0.18) is NOT AFFECTED by CVE-2020-27223. The vulnerable quadratic-time sorting algorithm in QuotedQualityCSV has been replaced with an efficient O(n log n) Comparator-based sort. This fix was applied by upstream vendor (Eclipse Jetty) in commit 10e531756b972162eed402c44d0244f7f6b85131 and was already included in upstream release 11.0.1, before TuxCare onboarded version 11.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2021-28165 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2021-28165 is NOT present in Jetty 11.0.18. The vulnerability involved an infinite loop causing 100% CPU usage when processing invalid large TLS frames (>17408 bytes). The fix was included in the upstream Jetty 11.0.18 release and is present in the target code at jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java lines 756-760. The defense checks if BufferUtil.space(_encryptedInput.getBuffer()) == 0 during BUFFER_UNDERFLOW and throws SSLHandshakeException to terminate the connection instead of looping infinitely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-28165" }, "impact_statement": "CVE-2021-28165 is NOT present in Jetty 11.0.18. The vulnerability involved an infinite loop causing 100% CPU usage when processing invalid large TLS frames (>17408 bytes). The fix was included in the upstream Jetty 11.0.18 release and is present in the target code at jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java lines 756-760. The defense checks if BufferUtil.space(_encryptedInput.getBuffer()) == 0 during BUFFER_UNDERFLOW and throws SSLHandshakeException to terminate the connection instead of looping infinitely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 11.0.18 is NOT AFFECTED. CVE-2021-34428 describes a vulnerability where exceptions thrown from SessionListener#sessionDestroyed() prevent session ID invalidation, potentially leaving users logged in. The upstream fix (commit cd6462a6252, May 2021) was already included in the Jetty 11.0.18 release (October 2023) that TuxCare onboarded. The target code at HEAD (1feed477b63) contain...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-34428" }, "impact_statement": "not_affected \u2014 Target version 11.0.18 is NOT AFFECTED. CVE-2021-34428 describes a vulnerability where exceptions thrown from SessionListener#sessionDestroyed() prevent session ID invalidation, potentially leaving users logged in. The upstream fix (commit cd6462a6252, May 2021) was already included in the Jetty 11.0.18 release (October 2023) that TuxCare onboarded. The target code at HEAD (1feed477b63) contain..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2022-2191 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. The target repository (Jetty 11.0.18-tuxcare.1) is not affected by CVE-2022-2191. The upstream fix (commit 66de7ba6180e41480af2f4220334b62832586fac by Ludovic Orban) was already present in the Jetty 11.0.18 release that TuxCare onboarded. The fix prevents ByteBuffer memory leaks during TLS handshake failures by adding buffer cleanup (discard and release) in all error code paths. The vulnerable pattern\u2014where ByteBuffers are not returned to the pool when exceptions occur during SSL processing\u2014is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-2191" }, "impact_statement": "The target repository (Jetty 11.0.18-tuxcare.1) is not affected by CVE-2022-2191. The upstream fix (commit 66de7ba6180e41480af2f4220334b62832586fac by Ludovic Orban) was already present in the Jetty 11.0.18 release that TuxCare onboarded. The fix prevents ByteBuffer memory leaks during TLS handshake failures by adding buffer cleanup (discard and release) in all error code paths. The vulnerable pattern\u2014where ByteBuffers are not returned to the pool when exceptions occur during SSL processing\u2014is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26048 affects Jetty multipart request handling, allowing attackers to cause OutOfMemoryError by sending parts with no filename but large content, or many parts. The target Jetty 11.0.18-tuxcare.1 is NOT AFFECTED because the upstream vendor (Webtide) applied the fix in commit a5344d7a260 (Feb 9, 2023) which was included in the upstream Jetty 11.0.18 release before TuxCare onboarded the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26048" }, "impact_statement": "not_affected \u2014 CVE-2023-26048 affects Jetty multipart request handling, allowing attackers to cause OutOfMemoryError by sending parts with no filename but large content, or many parts. The target Jetty 11.0.18-tuxcare.1 is NOT AFFECTED because the upstream vendor (Webtide) applied the fix in commit a5344d7a260 (Feb 9, 2023) which was included in the upstream Jetty 11.0.18 release before TuxCare onboarded the ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 (cookie smuggling via nonstandard quoted value parsing) is NOT present in Jetty 11.0.18. The upstream fix (commit 7b8c2c1bf08, PR #9339) was already included in the upstream 11.0.18 release that TuxCare onboarded. The fix introduced RFC6265CookieParser which properly rejects cookies with semicolons inside quoted values by marking them invalid and preventing their use in the appli...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26049" }, "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via nonstandard quoted value parsing) is NOT present in Jetty 11.0.18. The upstream fix (commit 7b8c2c1bf08, PR #9339) was already included in the upstream 11.0.18 release that TuxCare onboarded. The fix introduced RFC6265CookieParser which properly rejects cookies with semicolons inside quoted values by marking them invalid and preventing their use in the appli..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2024-13009 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. Jetty 11.0.18 is not affected by CVE-2024-13009. The vulnerability (buffer reuse on gzip decompression error) exists in Jetty 9.4.0-9.4.56 where content buffers were not nulled when gzip errors occurred. Jetty 11.x uses a refactored ContentProducer architecture with AsyncContentProducer.failCurrentContent() method that properly nulls both _rawContent and _transformedContent when the gzip interceptor throws an exception. This defense was introduced by upstream author Ludovic Orban (lorban@bitronix.be) in commit 973dfcf4f73 on 2021-04-19, years before CVE disclosure in December 2024, and shipped in the upstream Jetty 11.0.18 release that TuxCare onboarded on 2026-09-12.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-13009" }, "impact_statement": "Jetty 11.0.18 is not affected by CVE-2024-13009. The vulnerability (buffer reuse on gzip decompression error) exists in Jetty 9.4.0-9.4.56 where content buffers were not nulled when gzip errors occurred. Jetty 11.x uses a refactored ContentProducer architecture with AsyncContentProducer.failCurrentContent() method that properly nulls both _rawContent and _transformedContent when the gzip interceptor throws an exception. This defense was introduced by upstream author Ludovic Orban (lorban@bitronix.be) in commit 973dfcf4f73 on 2021-04-19, years before CVE disclosure in December 2024, and shipped in the upstream Jetty 11.0.18 release that TuxCare onboarded on 2026-09-12.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:59.961936+00:00", "status_notes": "Vulnerability CVE-2024-7708 is fixed in version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2024-7708" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2024-8184 is fixed in version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2024-8184" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2026-10051 affects version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-10051" }, "action_statement": "Vulnerability CVE-2026-10051 affects version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server. Jetty 11.0.18 is not affected by CVE-2026-1605. The vulnerability exists in Jetty 12.0.30 due to a specific architectural pattern where GzipRequest.destroy() is not called when only request inflation occurs (no response deflation). Jetty 11 uses a fundamentally different architecture: GzipHttpInputInterceptor handles inflation independently, and its lifecycle is managed by the HttpInput recycling mechanism which ensures destroy() is always called when request processing completes, regardless of whether response deflation occurs. The input and output handling are architecturally separate in Jetty 11, eliminating the conditional logic flaw that causes the leak in Jetty 12.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1605" }, "impact_statement": "Jetty 11.0.18 is not affected by CVE-2026-1605. The vulnerability exists in Jetty 12.0.30 due to a specific architectural pattern where GzipRequest.destroy() is not called when only request inflation occurs (no response deflation). Jetty 11 uses a fundamentally different architecture: GzipHttpInputInterceptor handles inflation independently, and its lifecycle is managed by the HttpInput recycling mechanism which ensures destroy() is always called when request processing completes, regardless of whether response deflation occurs. The input and output handling are architecturally separate in Jetty 11, eliminating the conditional logic flaw that causes the leak in Jetty 12." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.18-tuxcare.2" } } ], "timestamp": "2026-11-09T19:06:27.547498+00:00", "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-6790" } } ] }