{ "@id": "urn:uuid:91a7b2df-fe8d-416f-8de4-260abb73cb18", "role": "Document Creator", "author": "https://tuxcare.com", "version": 41, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T17:46:02.067236+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-03T15:04:56.336983+00:00", "status_notes": "Vulnerability CVE-2006-6969 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 affects Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3, which used predictable java.util.Random for session ID generation. The target (Jetty 11.0.26) is not affected because the fix was already present in the upstream release that TuxCare onboarded. The session ID manager (DefaultSessionIdManager.java) uses java.security.SecureRandom by default (line 359), which was in...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2006-6969" }, "impact_statement": "not_affected \u2014 CVE-2006-6969 affects Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3, which used predictable java.util.Random for session ID generation. The target (Jetty 11.0.26) is not affected because the fix was already present in the upstream release that TuxCare onboarded. The session ID manager (DefaultSessionIdManager.java) uses java.security.SecureRandom by default (line 359), which was in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2011-4461 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 hash collision DoS vulnerability is not present in target Jetty 11.0.26. The fix (limiting form parameters via maxFormKeys with default 1000) was already included in the upstream Jetty 11.0.26 release that TuxCare onboarded. The defense code exists in Request.java, ContextHandler.java, and UrlEncoded.java, and is active by default. Fix commit 085c79d7d6c by upstream author Greg Wi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-4461" }, "impact_statement": "not_affected \u2014 CVE-2011-4461 hash collision DoS vulnerability is not present in target Jetty 11.0.26. The fix (limiting form parameters via maxFormKeys with default 1000) was already included in the upstream Jetty 11.0.26 release that TuxCare onboarded. The defense code exists in Request.java, ContextHandler.java, and UrlEncoded.java, and is active by default. Fix commit 085c79d7d6c by upstream author Greg Wi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-06T17:46:02.067236+00:00", "status_notes": "Vulnerability CVE-2015-2080 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.26 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-2080" }, "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.26 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-03T15:26:39.614024+00:00", "status_notes": "Vulnerability CVE-2016-4800 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9, where the PathResource class on Windows failed to properly normalize paths containing escaped backslashes (%5C), allowing attackers to bypass protected resource restrictions. The vulnerability was fixed upstream by Joakim Erdfelt in commit 97af3d663fd (May 13, 2016), which modified PathResource to preserve the original URI representation s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4800" }, "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9, where the PathResource class on Windows failed to properly normalize paths containing escaped backslashes (%5C), allowing attackers to bypass protected resource restrictions. The vulnerability was fixed upstream by Joakim Erdfelt in commit 97af3d663fd (May 13, 2016), which modified PathResource to preserve the original URI representation s..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-03T12:38:41.778029+00:00", "status_notes": "Vulnerability CVE-2017-7656 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2017-7656 (HTTP Request Smuggling) is NOT PRESENT in target version 11.0.26. The upstream fix (commit a285deea42f by Greg Wilkins) was shipped in the upstream Jetty release before TuxCare onboarded version 11.0.26. The target code contains complete protections against request smuggling via ambiguous headers: validates and rejects multiple Content-Length headers with differing values, and detects both Content-Length and Transfer-Encoding headers. The default compliance mode (RFC7230) rejects all such violations. The vulnerable pattern (allowing ambiguous request framing) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7656" }, "impact_statement": "CVE-2017-7656 (HTTP Request Smuggling) is NOT PRESENT in target version 11.0.26. The upstream fix (commit a285deea42f by Greg Wilkins) was shipped in the upstream Jetty release before TuxCare onboarded version 11.0.26. The target code contains complete protections against request smuggling via ambiguous headers: validates and rejects multiple Content-Length headers with differing values, and detects both Content-Length and Transfer-Encoding headers. The default compliance mode (RFC7230) rejects all such violations. The vulnerable pattern (allowing ambiguous request framing) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2017-7657 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-7657" }, "action_statement": "Vulnerability CVE-2017-7657 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-03T12:17:09.103452+00:00", "status_notes": "Vulnerability CVE-2017-7658 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2017-7658 (HTTP Request Smuggling via duplicate Content-Length headers or Content-Length + Transfer-Encoding: chunked) is NOT present in Jetty 11.0.26. The vulnerability was fixed by upstream Eclipse Jetty in commit a285deea42f (May 2018, \"Issue #2529 RFC2616 vs RFC7230 cleanup\") which is included in the 11.0.26 release. The fix introduces _hasContentLength tracking and rejects requests with duplicate Content-Length headers or conflicting Content-Length + Transfer-Encoding headers with HTTP 400 BAD_REQUEST. The default compliance mode (RFC7230) enforces this protection, making the fix active by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7658" }, "impact_statement": "CVE-2017-7658 (HTTP Request Smuggling via duplicate Content-Length headers or Content-Length + Transfer-Encoding: chunked) is NOT present in Jetty 11.0.26. The vulnerability was fixed by upstream Eclipse Jetty in commit a285deea42f (May 2018, \"Issue #2529 RFC2616 vs RFC7230 cleanup\") which is included in the 11.0.26 release. The fix introduces _hasContentLength tracking and rejects requests with duplicate Content-Length headers or conflicting Content-Length + Transfer-Encoding headers with HTTP 400 BAD_REQUEST. The default compliance mode (RFC7230) enforces this protection, making the fix active by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-03T12:28:48.622691+00:00", "status_notes": "Vulnerability CVE-2017-9735 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2017-9735 timing attack vulnerability is not present in target Jetty 11.0.26. The target contains constant-time password comparison methods (stringEquals/byteEquals) that eliminate timing side-channels. This fix was authored by upstream maintainer Simone Bordet in 2017 and shipped in the upstream Jetty 11.0.26 release before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-9735" }, "impact_statement": "CVE-2017-9735 timing attack vulnerability is not present in target Jetty 11.0.26. The target contains constant-time password comparison methods (stringEquals/byteEquals) that eliminate timing side-channels. This fix was authored by upstream maintainer Simone Bordet in 2017 and shipped in the upstream Jetty 11.0.26 release before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-10-31T18:00:07.490522+00:00", "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 is NOT present in Jetty 11.0.26. The vulnerability allowed attackers to discover server file system paths through InvalidPathException messages when sending HTTP requests with malformed characters (e.g., control characters like %0a). The upstream fix by Joakim Erdfelt (commits 53e8bc2a636 and ad4dceb1c08) sanitizes all exceptions during resource loading to only expose the user-su...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12536" }, "impact_statement": "not_affected \u2014 CVE-2018-12536 is NOT present in Jetty 11.0.26. The vulnerability allowed attackers to discover server file system paths through InvalidPathException messages when sending HTTP requests with malformed characters (e.g., control characters like %0a). The upstream fix by Joakim Erdfelt (commits 53e8bc2a636 and ad4dceb1c08) sanitizes all exceptions during resource loading to only expose the user-su..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2018-12538 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2018-12538" }, "action_statement": "Vulnerability CVE-2018-12538 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-12545 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2018-12545 does not affect Jetty 11.0.26. The upstream vendor (Eclipse Jetty project) fixed this vulnerability in commits 9eca404 (issue #2722, July 2018) and cfe1baa (issue #3978, August 2019) before this version was released. Both defensive layers are present and active by default: (1) maxSettingsKeys validation limiting settings to 64 keys per connection, and (2) WindowRateControl limiting frame processing to 128 events/second. These fixes were part of the upstream release 11.0.26 that TuxCare onboarded, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12545" }, "impact_statement": "CVE-2018-12545 does not affect Jetty 11.0.26. The upstream vendor (Eclipse Jetty project) fixed this vulnerability in commits 9eca404 (issue #2722, July 2018) and cfe1baa (issue #3978, August 2019) before this version was released. Both defensive layers are present and active by default: (1) maxSettingsKeys validation limiting settings to 64 keys per connection, and (2) WindowRateControl limiting frame processing to 128 events/second. These fixes were part of the upstream release 11.0.26 that TuxCare onboarded, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-10-31T16:01:18.810144+00:00", "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 does not affect this target. The vulnerability (XSS in directory listings via percent-encoded special characters bypassing HTML escaping) was fixed in upstream Jetty commit 1565b5f160e (April 2019, issue #3549) by adding proper URL-decoding before HTML escaping. This fix was already present in the upstream Jetty 11.0.26 release that TuxCare onboarded. The defensive code is confir...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10241" }, "impact_statement": "not_affected \u2014 CVE-2019-10241 does not affect this target. The vulnerability (XSS in directory listings via percent-encoded special characters bypassing HTML escaping) was fixed in upstream Jetty commit 1565b5f160e (April 2019, issue #3549) by adding proper URL-decoding before HTML escaping. This fix was already present in the upstream Jetty 11.0.26 release that TuxCare onboarded. The defensive code is confir..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2019-10246 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 is not present in Jetty 11.0.26-tuxcare.3. The upstream fix (commit 7b774d82e82) was already included in the Jetty 11.0.26 release that TuxCare onboarded. The vulnerable code pattern (exposing fully qualified directory paths in directory listings) has been replaced with the getFileName() method that extracts and displays only the filename. The fix was authored by upstream develop...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10246" }, "impact_statement": "not_affected \u2014 CVE-2019-10246 is not present in Jetty 11.0.26-tuxcare.3. The upstream fix (commit 7b774d82e82) was already included in the Jetty 11.0.26 release that TuxCare onboarded. The vulnerable code pattern (exposing fully qualified directory paths in directory listings) has been replaced with the getFileName() method that extracts and displays only the filename. The fix was authored by upstream develop..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-10-31T16:24:35.622872+00:00", "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 affects Jetty versions 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older. The target version 11.0.26 is not vulnerable. The vulnerable code pattern (outputting context.toString() in the DefaultHandler's 404 error response, which revealed filesystem base resource paths) is not present in the target. The fix was shipped in the upstream Jetty release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10247" }, "impact_statement": "not_affected \u2014 CVE-2019-10247 affects Jetty versions 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older. The target version 11.0.26 is not vulnerable. The vulnerable code pattern (outputting context.toString() in the DefaultHandler's 404 error response, which revealed filesystem base resource paths) is not present in the target. The fix was shipped in the upstream Jetty release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-02T19:14:00.100615+00:00", "status_notes": "Vulnerability CVE-2019-17632 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 addresses XSS via unescaped exception messages in Jetty error pages (HTML/JSON). The target (Jetty 11.0.26) contains the upstream fix (commits 9e40fc9a6fb and cf0df6e3ffd) that adds StringUtil.sanitizeXmlString() sanitization. This fix was authored by upstream maintainer joakim.erdfelt@gmail.com and shipped in the upstream Jetty 11.0.26 release before TuxCare onboarded it (first ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17632" }, "impact_statement": "not_affected \u2014 CVE-2019-17632 addresses XSS via unescaped exception messages in Jetty error pages (HTML/JSON). The target (Jetty 11.0.26) contains the upstream fix (commits 9e40fc9a6fb and cf0df6e3ffd) that adds StringUtil.sanitizeXmlString() sanitization. This fix was authored by upstream maintainer joakim.erdfelt@gmail.com and shipped in the upstream Jetty 11.0.26 release before TuxCare onboarded it (first ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2019-17638 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. The target Jetty version 11.0.26-tuxcare.3 is not affected by CVE-2019-17638. The vulnerability involved a double-release of ByteBuffers in HttpConnection when response headers exceeded size limits, potentially leaking sensitive data between client requests. The fix (commit ff8ae56fa93) was authored by upstream maintainer Greg Wilkins (gregw@webtide.com) on June 3, 2020 and was already included in the upstream Jetty 11.0.26 release when TuxCare onboarded it. The fix adds releaseHeader() and releaseChunk() methods that properly null buffer references after release, preventing double-release into the buffer pool.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17638" }, "impact_statement": "The target Jetty version 11.0.26-tuxcare.3 is not affected by CVE-2019-17638. The vulnerability involved a double-release of ByteBuffers in HttpConnection when response headers exceeded size limits, potentially leaking sensitive data between client requests. The fix (commit ff8ae56fa93) was authored by upstream maintainer Greg Wilkins (gregw@webtide.com) on June 3, 2020 and was already included in the upstream Jetty 11.0.26 release when TuxCare onboarded it. The fix adds releaseHeader() and releaseChunk() methods that properly null buffer references after release, preventing double-release into the buffer pool.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-02T19:33:31.796686+00:00", "status_notes": "Vulnerability CVE-2020-27218 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 (GZIP request body inflation data injection) is NOT present in Jetty 11.0.26. The upstream fix (commit 14f94f738df) was already shipped in the Jetty 11.0.26 release that TuxCare onboarded. The defense mechanisms (ensureConsumeAllOrNotPersistent, consumeAll) are fully present and active in HttpChannel.java, HttpInput.java, and Response.java, protecting against unconsumed request b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27218" }, "impact_statement": "not_affected \u2014 CVE-2020-27218 (GZIP request body inflation data injection) is NOT present in Jetty 11.0.26. The upstream fix (commit 14f94f738df) was already shipped in the Jetty 11.0.26 release that TuxCare onboarded. The defense mechanisms (ensureConsumeAllOrNotPersistent, consumeAll) are fully present and active in HttpChannel.java, HttpInput.java, and Response.java, protecting against unconsumed request b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-02T19:25:14.724252+00:00", "status_notes": "Vulnerability CVE-2020-27223 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223 is NOT present in Jetty 11.0.26-tuxcare.3. The vulnerable O(n\u00b2) sorting algorithm in QuotedQualityCSV was fixed in upstream commit 10e531756b9 (Feb 2021) which replaced it with an O(n log n) comparator-based sort. This fix was already present in Jetty 11.0.26 when TuxCare onboarded it (first TuxCare commit: 804520a9c0c \"setup 11.0.26\" by askorik@cloudlinux.com). The fix author is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27223" }, "impact_statement": "not_affected \u2014 CVE-2020-27223 is NOT present in Jetty 11.0.26-tuxcare.3. The vulnerable O(n\u00b2) sorting algorithm in QuotedQualityCSV was fixed in upstream commit 10e531756b9 (Feb 2021) which replaced it with an O(n log n) comparator-based sort. This fix was already present in Jetty 11.0.26 when TuxCare onboarded it (first TuxCare commit: 804520a9c0c \"setup 11.0.26\" by askorik@cloudlinux.com). The fix author is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-03T12:23:26.744347+00:00", "status_notes": "Vulnerability CVE-2021-28165 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. The target repository (Jetty 11.0.26-tuxcare.3) is NOT affected by CVE-2021-28165. The vulnerability (CPU exhaustion via infinite loop when processing oversized TLS frames) was fixed in upstream Jetty 10.0.2 by commit 039c7386d0f, authored by Simone Bordet. This fix was already present in the upstream Jetty 11.0.26 release that TuxCare onboarded (commit 804520a9c0c \"setup 11.0.26\" by askorik@cloudlinux.com). The defensive code is present in SslConnection.java at lines 756-760, which checks buffer space availability before attempting further reads and throws SSLHandshakeException when the buffer is full, preventing the infinite processing loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-28165" }, "impact_statement": "The target repository (Jetty 11.0.26-tuxcare.3) is NOT affected by CVE-2021-28165. The vulnerability (CPU exhaustion via infinite loop when processing oversized TLS frames) was fixed in upstream Jetty 10.0.2 by commit 039c7386d0f, authored by Simone Bordet. This fix was already present in the upstream Jetty 11.0.26 release that TuxCare onboarded (commit 804520a9c0c \"setup 11.0.26\" by askorik@cloudlinux.com). The defensive code is present in SslConnection.java at lines 756-760, which checks buffer space availability before attempting further reads and throws SSLHandshakeException when the buffer is full, preventing the infinite processing loop.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-10-31T15:17:00.108725+00:00", "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Eclipse Jetty 11.0.26-tuxcare.3) is NOT AFFECTED by CVE-2021-34428. The vulnerability fix was already present in the upstream release 11.0.26 before TuxCare onboarded it. The fix (commit 087f486b4461746b4ded45833887b3ccb136ee85 by upstream developer janb@webtide.com) ensures session ID invalidation completes even when SessionListener#sessionDestroyed() throws exceptions, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-34428" }, "impact_statement": "not_affected \u2014 The target repository (Eclipse Jetty 11.0.26-tuxcare.3) is NOT AFFECTED by CVE-2021-34428. The vulnerability fix was already present in the upstream release 11.0.26 before TuxCare onboarded it. The fix (commit 087f486b4461746b4ded45833887b3ccb136ee85 by upstream developer janb@webtide.com) ensures session ID invalidation completes even when SessionListener#sessionDestroyed() throws exceptions, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2022-2191 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. The target (Jetty 11.0.26-tuxcare.3) is NOT AFFECTED by CVE-2022-2191. The vulnerability involved ByteBuffer leaks in SslConnection when TLS handshake errors occurred (e.g., expired client certificates). The upstream fix (commit 66de7ba6180) was already present in Jetty 11.0.10+ releases. Since TuxCare onboarded version 11.0.26, this fix was already included in the upstream release. The fix adds explicit buffer cleanup methods (discardInputBuffers, discardEncryptedOutputBuffer) that are called in exception handlers throughout SslConnection.java, preventing the memory leak.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-2191" }, "impact_statement": "The target (Jetty 11.0.26-tuxcare.3) is NOT AFFECTED by CVE-2022-2191. The vulnerability involved ByteBuffer leaks in SslConnection when TLS handshake errors occurred (e.g., expired client certificates). The upstream fix (commit 66de7ba6180) was already present in Jetty 11.0.10+ releases. Since TuxCare onboarded version 11.0.26, this fix was already included in the upstream release. The fix adds explicit buffer cleanup methods (discardInputBuffers, discardEncryptedOutputBuffer) that are called in exception handlers throughout SslConnection.java, preventing the memory leak.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-10-31T15:36:43.900585+00:00", "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26048 is NOT present in Jetty 11.0.26-tuxcare.3. The vulnerability allowed attackers to cause OutOfMemoryError via multipart requests with either (a) excessive number of parts or (b) parts without filename containing very large content. The fix (limiting part count and tracking cumulative size of non-file parts) was introduced in upstream Jetty by commit a5344d7a2609 on Feb 9, 2023, an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26048" }, "impact_statement": "not_affected \u2014 CVE-2023-26048 is NOT present in Jetty 11.0.26-tuxcare.3. The vulnerability allowed attackers to cause OutOfMemoryError via multipart requests with either (a) excessive number of parts or (b) parts without filename containing very large content. The fix (limiting part count and tracking cumulative size of non-file parts) was introduced in upstream Jetty by commit a5344d7a2609 on Feb 9, 2023, an..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-10-31T15:04:00.095012+00:00", "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.26-tuxcare.3) is NOT vulnerable to CVE-2023-26049. The vulnerability (cookie smuggling via semicolons in quoted cookie values) was fixed in upstream Jetty 11.0.15 via commits 7b8c2c1bf08 and 1be1401bafb (February 2023). The fix introduced RFC6265CookieParser which properly rejects cookies containing semicolons inside quoted values. Version 11.0.26 inherits this...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26049" }, "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.26-tuxcare.3) is NOT vulnerable to CVE-2023-26049. The vulnerability (cookie smuggling via semicolons in quoted cookie values) was fixed in upstream Jetty 11.0.15 via commits 7b8c2c1bf08 and 1be1401bafb (February 2023). The fix introduced RFC6265CookieParser which properly rejects cookies containing semicolons inside quoted values. Version 11.0.26 inherits this..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2024-13009 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2024-13009 explicitly affects Eclipse Jetty 9.4.0 to 9.4.56, where malformed gzip causes buffer reuse across requests. The target (Jetty 11.0.26-tuxcare.3) uses a fundamentally different architecture: no persistent _content field in HttpInput, ContentProducer pattern with proper cleanup (AsyncContentProducer.failCurrentContent() nulls content references at lines 220/229), and request-scoped GzipHttpInputInterceptor. The 9.4.x vulnerable pattern (reusable _content instance variable not nulled on gzip error) does not exist in the 11.x codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-13009" }, "impact_statement": "CVE-2024-13009 explicitly affects Eclipse Jetty 9.4.0 to 9.4.56, where malformed gzip causes buffer reuse across requests. The target (Jetty 11.0.26-tuxcare.3) uses a fundamentally different architecture: no persistent _content field in HttpInput, ContentProducer pattern with proper cleanup (AsyncContentProducer.failCurrentContent() nulls content references at lines 220/229), and request-scoped GzipHttpInputInterceptor. The 9.4.x vulnerable pattern (reusable _content instance variable not nulled on gzip error) does not exist in the 11.x codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2024-7708 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. Target Jetty 11.0.26 is not affected by CVE-2024-7708. The vulnerability (memory leak when HTTP requests with bodies result in 0-byte reads) was fixed in upstream Jetty 11.0.23 via commit 8259eabbc70. This fix was already present in the upstream 11.0.26 release that TuxCare onboarded, before any TuxCare modifications. The vulnerable code pattern (failure to release request buffers on fill()<=0) has been replaced with proper buffer cleanup in both normal and exception paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-7708" }, "impact_statement": "Target Jetty 11.0.26 is not affected by CVE-2024-7708. The vulnerability (memory leak when HTTP requests with bodies result in 0-byte reads) was fixed in upstream Jetty 11.0.23 via commit 8259eabbc70. This fix was already present in the upstream 11.0.26 release that TuxCare onboarded, before any TuxCare modifications. The vulnerable code pattern (failure to release request buffers on fill()<=0) has been replaced with proper buffer cleanup in both normal and exception paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8184 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2024-8184 does not affect this target. The vulnerable pattern (unbounded growth of the _remotes ConcurrentHashMap in ThreadLimitHandler) is absent because upstream Eclipse Jetty already fixed it in version 11.0.24 (commit d1a9ca11563 by Ludovic Orban, Aug 2024). The target is based on Jetty 11.0.26, which inherits the fix from upstream. The current code contains reference counting (Referenc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-8184" }, "impact_statement": "not_affected \u2014 CVE-2024-8184 does not affect this target. The vulnerable pattern (unbounded growth of the _remotes ConcurrentHashMap in ThreadLimitHandler) is absent because upstream Eclipse Jetty already fixed it in version 11.0.24 (commit d1a9ca11563 by Ludovic Orban, Aug 2024). The target is based on Jetty 11.0.26, which inherits the fix from upstream. The current code contains reference counting (Referenc..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10051 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-10051" }, "action_statement": "Vulnerability CVE-2026-10051 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server. Jetty 11.0.26 is outside the affected range (12.0.0\u201312.0.31 and 12.1.0\u201312.1.5). CVE-2026-1605 affects the Jetty 12 lifecycle where releasing the request Inflater depends on a response compression callback. This code path is absent in Jetty 11.0.26, where the gzip input interceptor is destroyed during request recycle regardless of response compression. Therefore, the vulnerable resource retention path does not exist in this version.", "vulnerability": { "name": "CVE-2026-1605" }, "impact_statement": "Jetty 11.0.26 is outside the affected range (12.0.0\u201312.0.31 and 12.1.0\u201312.1.5). CVE-2026-1605 affects the Jetty 12 lifecycle where releasing the request Inflater depends on a response compression callback. This code path is absent in Jetty 11.0.26, where the gzip input interceptor is destroyed during request recycle regardless of response compression. Therefore, the vulnerable resource retention path does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.26-tuxcare.2" } } ], "timestamp": "2026-10-27T21:23:22.979954+00:00", "status_notes": "Vulnerability CVE-2026-6790 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server, and is fixed in 11.0.26-tuxcare.3.", "vulnerability": { "name": "CVE-2026-6790" }, "action_statement": "Vulnerability CVE-2026-6790 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-server, and is fixed in 11.0.26-tuxcare.3." } ] }