{
  "@id": "urn:uuid:1522228a-8ee7-4633-9583-ad7699b18589",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 41,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T10:28:00.706705+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:05:45.890515+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 describes predictable session ID generation using java.util.Random in Jetty versions before 6.1.0pre3. The target repository is Jetty 11.0.27, which is 20 years newer than affected versions. Analysis of DefaultSessionIdManager.java confirms the target uses java.security.SecureRandom by default (line 359) for session ID generation. The vulnerable pattern (using java.util.Random by ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 describes predictable session ID generation using java.util.Random in Jetty versions before 6.1.0pre3. The target repository is Jetty 11.0.27, which is 20 years newer than affected versions. Analysis of DefaultSessionIdManager.java confirms the target uses java.security.SecureRandom by default (line 359) for session ID generation. The vulnerable pattern (using java.util.Random by ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 concerns a hash collision DoS vulnerability in Jetty's form parameter parsing. The target (Jetty 11.0.27) is NOT AFFECTED because the upstream vendor fix (commit 085c79d7d6c by Greg Wilkins) was already present in the upstream release that TuxCare onboarded. The fix introduces a maxFormKeys limit (default 1000) that prevents unbounded form parameter processing, and this defense is...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-4461 concerns a hash collision DoS vulnerability in Jetty's form parameter parsing. The target (Jetty 11.0.27) is NOT AFFECTED because the upstream vendor fix (commit 085c79d7d6c by Greg Wilkins) was already present in the upstream release that TuxCare onboarded. The fix introduces a maxFormKeys limit (default 1000) that prevents unbounded form parameter processing, and this defense is..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-06T17:46:02.067236+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.27 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.27 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:27:45.237635+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, allowing attackers to bypass protected resource restrictions via URLs with escaped backslashes (%5C). The target version 11.0.27.tuxcare0005 is not affected because the vulnerability was fixed in upstream commit 97af3d663fd (May 2016) by Joakim Erdfelt, which shipped in the upstream release before TuxCare's involvement. The fix ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, allowing attackers to bypass protected resource restrictions via URLs with escaped backslashes (%5C). The target version 11.0.27.tuxcare0005 is not affected because the vulnerability was fixed in upstream commit 97af3d663fd (May 2016) by Joakim Erdfelt, which shipped in the upstream release before TuxCare's involvement. The fix ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:39:18.885622+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. CVE-2017-7656 (HTTP Request Smuggling via ambiguous Content-Length/Transfer-Encoding headers) is NOT present in Jetty 11.0.27. The upstream fix (commit a285deea42f by Greg Wilkins) was already included in the Jetty 11.0.x release that TuxCare onboarded. In the default RFC7230 compliance mode, the parser rejects: (1) multiple Content-Length headers, (2) both Content-Length and Transfer-Encoding headers, and (3) excessively large chunk sizes. These defenses prevent the request smuggling attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "CVE-2017-7656 (HTTP Request Smuggling via ambiguous Content-Length/Transfer-Encoding headers) is NOT present in Jetty 11.0.27. The upstream fix (commit a285deea42f by Greg Wilkins) was already included in the Jetty 11.0.x release that TuxCare onboarded. In the default RFC7230 compliance mode, the parser rejects: (1) multiple Content-Length headers, (2) both Content-Length and Transfer-Encoding headers, and (3) excessively large chunk sizes. These defenses prevent the request smuggling attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-09T10:28:00.706705+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. Prechecker: the upstream fix is already in this version's git history (commits 1a4d304a, 715a637c, a285deea, d35a332b, e05c11ae). Advisories: GitHub says fixed in 9.2.25 and 9.3.24 and NVD in 9.4.11, and this version is on a newer line; the cve.org record reads as affected only because it writes each range as two half-entries. Confirmed not affected by the Java ELS team review on 2026-11-06.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "impact_statement": "Prechecker: the upstream fix is already in this version's git history (commits 1a4d304a, 715a637c, a285deea, d35a332b, e05c11ae). Advisories: GitHub says fixed in 9.2.25 and 9.3.24 and NVD in 9.4.11, and this version is on a newer line; the cve.org record reads as affected only because it writes each range as two half-entries. Confirmed not affected by the Java ELS team review on 2026-11-06."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. CVE-2017-7658 (HTTP Request Smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding) is NOT present in Jetty 11.0.27. The fix was authored by Greg Wilkins (upstream) in commit a285deea42f (May 2018) and was already included in the upstream Jetty 11.0.26 release that TuxCare onboarded. The vulnerable code pattern does not exist in the default configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "CVE-2017-7658 (HTTP Request Smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding) is NOT present in Jetty 11.0.27. The fix was authored by Greg Wilkins (upstream) in commit a285deea42f (May 2018) and was already included in the upstream Jetty 11.0.26 release that TuxCare onboarded. The vulnerable code pattern does not exist in the default configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:28:48.622691+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. CVE-2017-9735 timing channel vulnerability is NOT present in target version 11.0.27. The upstream fix (commit 042f325f1cd by Simone Bordet, May 2017) replaced variable-time password comparison with constant-time methods to prevent timing side-channel attacks. This fix was already included in the upstream Jetty release that TuxCare onboarded for version 11.0.26. The target code uses stringEquals() and byteEquals() constant-time comparison methods throughout Password.java and Credential.java, preventing attackers from inferring password information through timing analysis.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 timing channel vulnerability is NOT present in target version 11.0.27. The upstream fix (commit 042f325f1cd by Simone Bordet, May 2017) replaced variable-time password comparison with constant-time methods to prevent timing side-channel attacks. This fix was already included in the upstream Jetty release that TuxCare onboarded for version 11.0.26. The target code uses stringEquals() and byteEquals() constant-time comparison methods throughout Password.java and Credential.java, preventing attackers from inferring password information through timing analysis.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-10-31T17:59:35.570487+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 is not present in Jetty 11.0.27. The vulnerability (information disclosure of full server filesystem paths via InvalidPathException in error responses) was fixed in the upstream Jetty codebase in May 2018 (commit ad4dceb1c08). The fix wraps resource loading exceptions in sanitized InvalidPathException instances containing only the user-provided path context, preventing full files...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 is not present in Jetty 11.0.27. The vulnerability (information disclosure of full server filesystem paths via InvalidPathException in error responses) was fixed in the upstream Jetty codebase in May 2018 (commit ad4dceb1c08). The fix wraps resource loading exceptions in sanitized InvalidPathException instances containing only the user-provided path context, preventing full files..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. CVE-2018-12545 is NOT present in Jetty 11.0.27. The vulnerability (unbounded accumulation of SETTINGS frame key-value pairs leading to DoS through resource exhaustion) was fixed in the upstream Jetty project in July 2018 (commit 9eca404da29). The fix adds a configurable limit (maxSettingsKeys, default 64) that rejects connections exceeding the limit with ENHANCE_YOUR_CALM_ERROR. This fix is present in the target repository at jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/parser/SettingsBodyParser.java lines 193-199, actively enforced on all HTTP/2 SETTINGS frame processing paths. The fix was included in the upstream Jetty 11.0.26 release that TuxCare onboarded, making this an upstream-provided defense rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 is NOT present in Jetty 11.0.27. The vulnerability (unbounded accumulation of SETTINGS frame key-value pairs leading to DoS through resource exhaustion) was fixed in the upstream Jetty project in July 2018 (commit 9eca404da29). The fix adds a configurable limit (maxSettingsKeys, default 64) that rejects connections exceeding the limit with ENHANCE_YOUR_CALM_ERROR. This fix is present in the target repository at jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/parser/SettingsBodyParser.java lines 193-199, actively enforced on all HTTP/2 SETTINGS frame processing paths. The fix was included in the upstream Jetty 11.0.26 release that TuxCare onboarded, making this an upstream-provided defense rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:01:42.763376+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 XSS vulnerability in directory listings is NOT present in Jetty 11.0.27. The upstream Eclipse Jetty project already fixed this vulnerability in commits ca77bd3 (Issue #3319) and 1565b5f160e (Issue #3549), which shipped in the upstream release before TuxCare began maintaining version 11.0.26. The fixes include proper HTML escaping via deTag() and URL encoding via hrefEncodeURI() i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 XSS vulnerability in directory listings is NOT present in Jetty 11.0.27. The upstream Eclipse Jetty project already fixed this vulnerability in commits ca77bd3 (Issue #3319) and 1565b5f160e (Issue #3549), which shipped in the upstream release before TuxCare began maintaining version 11.0.26. The fixes include proper HTML escaping via deTag() and URL encoding via hrefEncodeURI() i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 affects Jetty versions 9.2.27, 9.3.26, and 9.4.16 where directory listings on Windows could expose fully qualified filesystem paths. The target repository (Jetty 11.0.27.tuxcare0005) is NOT AFFECTED because the upstream vendor fix (commit 7b774d82e82 from April 2019) was already included in Jetty 11.0.26 when TuxCare onboarded it in December 2025. The fix adds a getFileName() met...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 affects Jetty versions 9.2.27, 9.3.26, and 9.4.16 where directory listings on Windows could expose fully qualified filesystem paths. The target repository (Jetty 11.0.27.tuxcare0005) is NOT AFFECTED because the upstream vendor fix (commit 7b774d82e82 from April 2019) was already included in Jetty 11.0.26 when TuxCare onboarded it in December 2025. The fix adds a getFileName() met..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:24:09.276103+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 describes an information disclosure vulnerability where Jetty's DefaultHandler reveals the configured fully qualified directory base resource location in 404 error pages via context.toString() output. The target repository (Jetty 11.0.27.tuxcare0005) is NOT affected because the vulnerable code pattern was removed in upstream Jetty commits 04c994712c0 and 9f506e4123b (Issue #3555)...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 describes an information disclosure vulnerability where Jetty's DefaultHandler reveals the configured fully qualified directory base resource location in 404 error pages via context.toString() output. The target repository (Jetty 11.0.27.tuxcare0005) is NOT affected because the vulnerable code pattern was removed in upstream Jetty commits 04c994712c0 and 9f506e4123b (Issue #3555)..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:14:00.100615+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 affects Eclipse Jetty versions 9.4.21-9.4.23 where exception messages in error responses (text/html and text/json) were not escaped, allowing XSS. The target repository (Jetty 11.0.27.tuxcare0005) is NOT AFFECTED because the upstream vendor's fix (commits 9e40fc9a6fb and cf0df6e3ffd from November 2019) was already included in the upstream Jetty 11.0.26 release that TuxCare onboar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 affects Eclipse Jetty versions 9.4.21-9.4.23 where exception messages in error responses (text/html and text/json) were not escaped, allowing XSS. The target repository (Jetty 11.0.27.tuxcare0005) is NOT AFFECTED because the upstream vendor's fix (commits 9e40fc9a6fb and cf0df6e3ffd from November 2019) was already included in the upstream Jetty 11.0.26 release that TuxCare onboar..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. The target repository (Eclipse Jetty 11.0.27) is NOT affected by CVE-2019-17638. The vulnerability pattern (double-release of ByteBuffer in HEADER_OVERFLOW case) is not present because the upstream fix was already included in Jetty 10.0.0+, which predates the TuxCare onboarding of version 11.0.26. The fix commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba by Greg Wilkins (gregw@webtide.com) properly implements the releaseHeader() method that nulls buffer references after release, preventing the double-release vulnerability described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "The target repository (Eclipse Jetty 11.0.27) is NOT affected by CVE-2019-17638. The vulnerability pattern (double-release of ByteBuffer in HEADER_OVERFLOW case) is not present because the upstream fix was already included in Jetty 10.0.0+, which predates the TuxCare onboarding of version 11.0.26. The fix commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba by Greg Wilkins (gregw@webtide.com) properly implements the releaseHeader() method that nulls buffer references after release, preventing the double-release vulnerability described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:33:08.890881+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 fix was already present in the upstream Jetty 11.0.x release that TuxCare onboarded. The target repository (version 11.0.27.tuxcare0005) contains the complete fix (commit 14f94f738df) authored by upstream maintainer Greg Wilkins, which prevents unconsumed GZIP request body data from leaking into subsequent requests on the same HTTP connection. The vulnerable pattern described in ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 fix was already present in the upstream Jetty 11.0.x release that TuxCare onboarded. The target repository (version 11.0.27.tuxcare0005) contains the complete fix (commit 14f94f738df) authored by upstream maintainer Greg Wilkins, which prevents unconsumed GZIP request body data from leaking into subsequent requests on the same HTTP connection. The vulnerable pattern described in ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:28:01.029212+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223 affects Jetty's QuotedQualityCSV class which had an inefficient O(n\u00b2) bubble-sort algorithm causing DoS when processing headers with many quality parameters. The target repository (Jetty 11.0.27) contains the FIXED version with efficient O(n log n) sorting using the QualityValue inner class and Java streams. This fix was introduced in upstream commit 10e531756b9 (Feb 18, 2021) an...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27223 affects Jetty's QuotedQualityCSV class which had an inefficient O(n\u00b2) bubble-sort algorithm causing DoS when processing headers with many quality parameters. The target repository (Jetty 11.0.27) contains the FIXED version with efficient O(n log n) sorting using the QualityValue inner class and Java streams. This fix was introduced in upstream commit 10e531756b9 (Feb 18, 2021) an..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:23:26.744347+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. CVE-2021-28165 NOT AFFECTED: The vulnerable infinite loop pattern in SSL/TLS BUFFER_UNDERFLOW handling is absent from target version 11.0.27. Upstream Jetty developers fixed this in commit 039c7386d0f (March 22, 2021) by reordering buffer space checks to execute BEFORE netFilled checks, preventing CPU exhaustion when processing large TLS frames. This fix was already present in the upstream release that TuxCare onboarded (first TuxCare commit 36280f393a1 on 2021-03-26 comes AFTER the fix). Target code at SslConnection.java:756-760 includes the corrected check order plus an additional compaction optimization added in commit 96f707f74b9.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "CVE-2021-28165 NOT AFFECTED: The vulnerable infinite loop pattern in SSL/TLS BUFFER_UNDERFLOW handling is absent from target version 11.0.27. Upstream Jetty developers fixed this in commit 039c7386d0f (March 22, 2021) by reordering buffer space checks to execute BEFORE netFilled checks, preventing CPU exhaustion when processing large TLS frames. This fix was already present in the upstream release that TuxCare onboarded (first TuxCare commit 36280f393a1 on 2021-03-26 comes AFTER the fix). Target code at SslConnection.java:756-760 includes the corrected check order plus an additional compaction optimization added in commit 96f707f74b9.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:21:00.131551+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.27.tuxcare0005) is NOT affected by CVE-2021-34428. The vulnerability\u2014where exceptions thrown from SessionListener#sessionDestroyed() could prevent session ID invalidation in the session ID manager\u2014has already been fixed by upstream commit 087f486b446 authored by Jan Bartel (janb@webtide.com). This fix shipped in the upstream release before TuxCare's first commi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.27.tuxcare0005) is NOT affected by CVE-2021-34428. The vulnerability\u2014where exceptions thrown from SessionListener#sessionDestroyed() could prevent session ID invalidation in the session ID manager\u2014has already been fixed by upstream commit 087f486b446 authored by Jan Bartel (janb@webtide.com). This fix shipped in the upstream release before TuxCare's first commi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. The target repository (Jetty 11.0.27) is not affected by CVE-2022-2191. The vulnerability involved ByteBuffer leaks in SslConnection's error handling paths during TLS operations. The upstream fix (commit 66de7ba6180e41480af2f4220334b62832586fac from June 2022) was already present in the upstream Jetty release when TuxCare onboarded version 11.0.26. The fix adds proper buffer cleanup methods (discardInputBuffers, discardEncryptedOutputBuffer) and calls them in all critical error paths, preventing the memory leak. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "The target repository (Jetty 11.0.27) is not affected by CVE-2022-2191. The vulnerability involved ByteBuffer leaks in SslConnection's error handling paths during TLS operations. The upstream fix (commit 66de7ba6180e41480af2f4220334b62832586fac from June 2022) was already present in the upstream Jetty release when TuxCare onboarded version 11.0.26. The fix adds proper buffer cleanup methods (discardInputBuffers, discardEncryptedOutputBuffer) and calls them in all critical error paths, preventing the memory leak. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:37:03.283122+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.27) is not affected by CVE-2023-26048. The vulnerability, which allowed multipart requests to exhaust server memory through excessive parts or large parts without filenames, was fixed in upstream Jetty 11.0.14 (February 2023) via commit a5344d7a2609 by Lachlan Roberts (lachlan@webtide.com). TuxCare began maintaining this codebase from version 11.0.26 (December ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.27) is not affected by CVE-2023-26048. The vulnerability, which allowed multipart requests to exhaust server memory through excessive parts or large parts without filenames, was fixed in upstream Jetty 11.0.14 (February 2023) via commit a5344d7a2609 by Lachlan Roberts (lachlan@webtide.com). TuxCare began maintaining this codebase from version 11.0.26 (December ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:05:00.234196+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 11.0.27 is NOT AFFECTED by CVE-2023-26049 (cookie smuggling via semicolons in quoted values). The vulnerability was fixed in upstream Jetty 11.0.14 via commit 7b8c2c1bf081c7f408e5da3371c8c3c9802f09fd, which introduced RFC6265CookieParser. This fix was already present in the upstream release that TuxCare onboarded (version 11.0.26, first TuxCare commit 36280f393a1). The defense ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 11.0.27 is NOT AFFECTED by CVE-2023-26049 (cookie smuggling via semicolons in quoted values). The vulnerability was fixed in upstream Jetty 11.0.14 via commit 7b8c2c1bf081c7f408e5da3371c8c3c9802f09fd, which introduced RFC6265CookieParser. This fix was already present in the upstream release that TuxCare onboarded (version 11.0.26, first TuxCare commit 36280f393a1). The defense ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. Jetty 11.0.27 is not affected by CVE-2024-13009. This vulnerability was specific to Jetty 9.4.x (versions 9.4.0-9.4.56) where the HttpInput._content field was not cleared on gzip inflation errors, enabling buffer reuse between requests. Jetty 11.0.x uses a fundamentally different ContentProducer architecture (introduced in Jetty 10.x) that includes comprehensive buffer cleanup on all error paths, eliminating the vulnerability pattern by design. The vulnerable code pattern does not exist in Jetty 11.0.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "Jetty 11.0.27 is not affected by CVE-2024-13009. This vulnerability was specific to Jetty 9.4.x (versions 9.4.0-9.4.56) where the HttpInput._content field was not cleared on gzip inflation errors, enabling buffer reuse between requests. Jetty 11.0.x uses a fundamentally different ContentProducer architecture (introduced in Jetty 10.x) that includes comprehensive buffer cleanup on all error paths, eliminating the vulnerability pattern by design. The vulnerable code pattern does not exist in Jetty 11.0.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. CVE-2024-7708 affects Jetty 11.0.0-11.0.22 with a memory leak when HTTP request body reads return 0 bytes (e.g., 100-Continue, slow networks). The target version 11.0.27 is NOT affected because the upstream fix commit 8259eabbc70 by Simone Bordet was already present in the upstream Jetty 11.0.27 release that TuxCare onboarded. The fix adds releaseRequestBuffer() calls when filled<=0 (line 385) and in exception handlers (line 401), preventing buffer accumulation. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "CVE-2024-7708 affects Jetty 11.0.0-11.0.22 with a memory leak when HTTP request body reads return 0 bytes (e.g., 100-Continue, slow networks). The target version 11.0.27 is NOT affected because the upstream fix commit 8259eabbc70 by Simone Bordet was already present in the upstream Jetty 11.0.27 release that TuxCare onboarded. The fix adds releaseRequestBuffer() calls when filled<=0 (line 385) and in exception handlers (line 401), preventing buffer accumulation. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. Version 11.0.27 is not vulnerable. Summary: The target repository already has the CVE-2024-8184 fix applied. The ThreadLimitHandler implementation uses atomic compute() operations with reference counting, preventing the memory leak vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 11.0.27 is not vulnerable. Summary: The target repository already has the CVE-2024-8184 fix applied. The ThreadLimitHandler implementation uses atomic compute() operations with reference counting, preventing the memory leak vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.27.tuxcare0004) does not exhibit the vulnerability pattern described in CVE-2026-10051. The CVE describes a connection-scoped _trailers field in Jetty 12.x's HttpConnection that is never reset between requests, causing trailer data from request N to leak into request N+1 on keep-alive connections. In Jetty 11.x (the target version), trailers are managed by Http...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.27.tuxcare0004) does not exhibit the vulnerability pattern described in CVE-2026-10051. The CVE describes a connection-scoped _trailers field in Jetty 12.x's HttpConnection that is never reset between requests, causing trailer data from request N to leak into request N+1 on keep-alive connections. In Jetty 11.x (the target version), trailers are managed by Http..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. Version 11.0.27 is not vulnerable. Summary: CVE-2026-1605 does not apply to this Jetty 11.0.27 repository. The vulnerability specifically affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), which has a fundamentally different architecture than Jetty 11.x. The vulnerable code patterns and files (GzipRequest, GzipDecoderSource, ContentSourceTransformer) do not exist in Jetty 11.x. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 11.0.27 is not vulnerable. Summary: CVE-2026-1605 does not apply to this Jetty 11.0.27 repository. The vulnerability specifically affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), which has a fundamentally different architecture than Jetty 11.x. The vulnerable code patterns and files (GzipRequest, GzipDecoderSource, ContentSourceTransformer) do not exist in Jetty 11.x. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.27.tuxcare00001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 does not affect version 11.0.27.tuxcare00001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 11.0.27.tuxcare0004 contains an upstream-authored fix from commit 5f25f5b389d (Feb 2023) that validates Host header against :authority pseudo-header for HTTP/2 and HTTP/3 requests. The defense rejects mismatched values with 400 Bad Request before application logic executes, preventing the dual-host-identity confusion described in CVE-2026-6790.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.27.tuxcare0004 contains an upstream-authored fix from commit 5f25f5b389d (Feb 2023) that validates Host header against :authority pseudo-header for HTTP/2 and HTTP/3 requests. The defense rejects mismatched values with 400 Bad Request before application logic executes, preventing the dual-host-identity confusion described in CVE-2026-6790."
    }
  ]
}