{
  "@id": "urn:uuid:1205d3a3-9628-4674-acc7-2c7c5e484409",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 38,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:05:28.850476+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:11:26.566722+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 describes predictable session ID generation using java.util.Random in old Jetty versions (before 4.2.27, 5.1.12, 6.0.2, 6.1.0pre3). The target version 11.0.33 includes the upstream fix from 2010 (JETTY-1202, commit c3275730b913) that changed session ID generation to use SecureRandom as the primary method. While fallback code to java.util.Random exists for extraordinary failure sce...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 describes predictable session ID generation using java.util.Random in old Jetty versions (before 4.2.27, 5.1.12, 6.0.2, 6.1.0pre3). The target version 11.0.33 includes the upstream fix from 2010 (JETTY-1202, commit c3275730b913) that changed session ID generation to use SecureRandom as the primary method. While fallback code to java.util.Random exists for extraordinary failure sce..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 affects Jetty versions that lack protection against hash collision DoS attacks via unbounded form parameter processing. The target repository (Jetty 11.0.33.tuxcare0001) contains the upstream fix (commit 085c79d7d6c by Greg Wilkins) which limits form parameter keys to 1000 by default. This fix was already present in the upstream release before TuxCare onboarded version 11.0.26 (co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-4461 affects Jetty versions that lack protection against hash collision DoS attacks via unbounded form parameter processing. The target repository (Jetty 11.0.33.tuxcare0001) contains the upstream fix (commit 085c79d7d6c by Greg Wilkins) which limits form parameter keys to 1000 by default. This fix was already present in the upstream release before TuxCare onboarded version 11.0.26 (co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T17:48:00.459476+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.33 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.33 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:32:29.747187+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, allowing path traversal via escaped backslashes in URLs. The target repository (Jetty 11.0.33) is not affected because the vulnerability was fixed by upstream commit 97af3d663fd on May 13, 2016, before TuxCare's first onboarding commit (b589976fdce \"setup 11.0.26\"). The fix reworks PathResource and FileResource alias checking to...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, allowing path traversal via escaped backslashes in URLs. The target repository (Jetty 11.0.33) is not affected because the vulnerability was fixed by upstream commit 97af3d663fd on May 13, 2016, before TuxCare's first onboarding commit (b589976fdce \"setup 11.0.26\"). The fix reworks PathResource and FileResource alias checking to..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:45:34.333226+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7656 (HTTP Request Smuggling via conflicting Content-Length/Transfer-Encoding headers) is NOT present in Jetty 11.0.33. The upstream vendor fix (commit e4d596eafc8 by joakim.erdfelt@gmail.com, Aug 2023) was already included in the Jetty 11.0.26 release that TuxCare onboarded. The target contains defense code in HttpParser.java (lines 1003-1030) that checks for MULTIPLE_CONTENT_LENGTHS and TRANSFER_ENCODING_WITH_CONTENT_LENGTH violations. In the default RFC7230 compliance mode, these checks throw BadMessageException (HTTP 400), blocking request smuggling attacks. The vulnerable code pattern (accepting conflicting message framing headers without validation) has been removed by the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "CVE-2017-7656 (HTTP Request Smuggling via conflicting Content-Length/Transfer-Encoding headers) is NOT present in Jetty 11.0.33. The upstream vendor fix (commit e4d596eafc8 by joakim.erdfelt@gmail.com, Aug 2023) was already included in the Jetty 11.0.26 release that TuxCare onboarded. The target contains defense code in HttpParser.java (lines 1003-1030) that checks for MULTIPLE_CONTENT_LENGTHS and TRANSFER_ENCODING_WITH_CONTENT_LENGTH violations. In the default RFC7230 compliance mode, these checks throw BadMessageException (HTTP 400), blocking request smuggling attacks. The vulnerable code pattern (accepting conflicting message framing headers without validation) has been removed by the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:46:45.783631+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7657 affects Jetty 9.2.x and older, 9.3.x due to integer overflow in chunk length parsing. The target (Jetty 11.0.33) is not affected because the vulnerability was fixed in upstream Jetty before this version was released. The fix (commit 2ef92681112 by Simone Bordet, 2026-02-27) implements robust overflow protection through two mechanisms: (1) limiting chunk size to 16 hex digits maximum, and (2) detecting overflow by checking if _chunkLength becomes negative after multiplication. This fix was already present in upstream Jetty 11.0.26+ when TuxCare onboarded the codebase, making it an upstream-shipped fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "impact_statement": "CVE-2017-7657 affects Jetty 9.2.x and older, 9.3.x due to integer overflow in chunk length parsing. The target (Jetty 11.0.33) is not affected because the vulnerability was fixed in upstream Jetty before this version was released. The fix (commit 2ef92681112 by Simone Bordet, 2026-02-27) implements robust overflow protection through two mechanisms: (1) limiting chunk size to 16 hex digits maximum, and (2) detecting overflow by checking if _chunkLength becomes negative after multiplication. This fix was already present in upstream Jetty 11.0.26+ when TuxCare onboarded the codebase, making it an upstream-shipped fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:23:26.744347+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7658 is NOT present in Jetty 11.0.33. The vulnerability (HTTP request smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding) was fixed in upstream commit 890c0b26 (Oct 2019) by Joakim Erdfelt, which shipped in the upstream release that TuxCare onboarded. The target uses a compliance-mode architecture with RFC7230 as default, which rejects both attack vectors with HTTP 400. Defense code exists in HttpParser.java lines 1003-1026 with checkViolation() calls that throw BadMessageException when violations are not allowed by the compliance mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "CVE-2017-7658 is NOT present in Jetty 11.0.33. The vulnerability (HTTP request smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding) was fixed in upstream commit 890c0b26 (Oct 2019) by Joakim Erdfelt, which shipped in the upstream release that TuxCare onboarded. The target uses a compliance-mode architecture with RFC7230 as default, which rejects both attack vectors with HTTP 400. Defense code exists in HttpParser.java lines 1003-1026 with checkViolation() calls that throw BadMessageException when violations are not allowed by the compliance mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:35:45.229167+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-9735 describes a timing channel attack in Jetty's password comparison logic. The target (Jetty 11.0.33) is NOT AFFECTED because the vulnerable pattern is not present. The upstream fix introducing constant-time comparison functions (stringEquals/byteEquals) was already shipped in Jetty 11.0.26, before TuxCare's first commit on this branch. The target contains sophisticated constant-time comparison implementations that prevent timing attacks by always iterating through the full input length regardless of match positions, using bitwise AND accumulation without short-circuiting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 describes a timing channel attack in Jetty's password comparison logic. The target (Jetty 11.0.33) is NOT AFFECTED because the vulnerable pattern is not present. The upstream fix introducing constant-time comparison functions (stringEquals/byteEquals) was already shipped in Jetty 11.0.26, before TuxCare's first commit on this branch. The target contains sophisticated constant-time comparison implementations that prevent timing attacks by always iterating through the full input length regardless of match positions, using bitwise AND accumulation without short-circuiting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T18:18:32.564111+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 describes an information disclosure vulnerability where invalid path characters in HTTP requests trigger InvalidPathException containing the full server filesystem path in error responses. The target (Jetty 11.0.33.tuxcare0001) is NOT AFFECTED because the upstream vendor fix is already present. ResourceContentFactory.getContent() (lines 50-68) catches all Throwable exceptions dur...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 describes an information disclosure vulnerability where invalid path characters in HTTP requests trigger InvalidPathException containing the full server filesystem path in error responses. The target (Jetty 11.0.33.tuxcare0001) is NOT AFFECTED because the upstream vendor fix is already present. ResourceContentFactory.getContent() (lines 50-68) catches all Throwable exceptions dur..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. Jetty 11.0.33 is not affected by CVE-2018-12545. The vulnerability (DoS via large or numerous HTTP/2 SETTINGS frames) was fixed in upstream commits 9eca404 and 508ad4a, both authored by Simone Bordet (upstream maintainer). These fixes were already present in the upstream release 11.0.26 that TuxCare onboarded. The target contains both key mitigations: (1) maxSettingsKeys limit (default 64) enforced in SettingsBodyParser.onSetting() at lines 195-197, and (2) RateControl mechanism checking frame rates at line 223. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "Jetty 11.0.33 is not affected by CVE-2018-12545. The vulnerability (DoS via large or numerous HTTP/2 SETTINGS frames) was fixed in upstream commits 9eca404 and 508ad4a, both authored by Simone Bordet (upstream maintainer). These fixes were already present in the upstream release 11.0.26 that TuxCare onboarded. The target contains both key mitigations: (1) maxSettingsKeys limit (default 64) enforced in SettingsBodyParser.onSetting() at lines 195-197, and (2) RateControl mechanism checking frame rates at line 223. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:19:00.081142+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.33) is not affected by CVE-2019-10241. The XSS vulnerability in directory listings was fixed in upstream Jetty commit 3d028ab2ca7 (April 2019) before TuxCare onboarded version 11.0.26. The fix introduced getFileName() method which properly URL-decodes filenames and sanitizes output through deTag() and hrefEncodeURI() methods, preventing malicious path segments ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.33) is not affected by CVE-2019-10241. The XSS vulnerability in directory listings was fixed in upstream Jetty commit 3d028ab2ca7 (April 2019) before TuxCare onboarded version 11.0.26. The fix introduced getFileName() method which properly URL-decodes filenames and sanitizes output through deTag() and hrefEncodeURI() methods, preventing malicious path segments ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 11.0.33 is not affected by CVE-2019-10246. The vulnerability involved exposing fully qualified filesystem paths in directory listings on Windows. The upstream fix (commit 3d028ab2ca7 by Joakim Erdfelt, April 2019) replaced the vulnerable pattern where getName() returned full paths with a new getFileName() method that extracts only the filename segment. This fix was included in ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 11.0.33 is not affected by CVE-2019-10246. The vulnerability involved exposing fully qualified filesystem paths in directory listings on Windows. The upstream fix (commit 3d028ab2ca7 by Joakim Erdfelt, April 2019) replaced the vulnerable pattern where getName() returned full paths with a new getFileName() method that extracts only the filename segment. This fix was included in ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:40:00.680954+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 is not present in Jetty 11.0.33.tuxcare0001. The vulnerability involved the DefaultHandler revealing filesystem base resource paths via context.toString() in 404 error pages. The upstream fix (commit 04c994712c0) removed this disclosure and shipped in the upstream Jetty release before TuxCare onboarded version 11.0.26. The target's DefaultHandler.java contains no context.toString...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 is not present in Jetty 11.0.33.tuxcare0001. The vulnerability involved the DefaultHandler revealing filesystem base resource paths via context.toString() in 404 error pages. The upstream fix (commit 04c994712c0) removed this disclosure and shipped in the upstream Jetty release before TuxCare onboarded version 11.0.26. The target's DefaultHandler.java contains no context.toString..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:19:00.599819+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 is NOT present in the target. The vulnerability (unescaped exception messages in error responses leading to XSS) was fixed by upstream Jetty in commits 9e40fc9a6fb and cf0df6e3ffd (Issue #4334). These fixes were already included in upstream Jetty 11.0.26, which predates TuxCare's onboarding of this codebase (first TuxCare commit b589976fdce \"setup 11.0.26\"). The target version 11...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 is NOT present in the target. The vulnerability (unescaped exception messages in error responses leading to XSS) was fixed by upstream Jetty in commits 9e40fc9a6fb and cf0df6e3ffd (Issue #4334). These fixes were already included in upstream Jetty 11.0.26, which predates TuxCare's onboarding of this codebase (first TuxCare commit b589976fdce \"setup 11.0.26\"). The target version 11..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2019-17638 (ByteBuffer double-release causing information disclosure) is NOT present in Jetty 11.0.33. The upstream fix (commit ff8ae56fa93 by gregw@webtide.com) was already included in the upstream release that TuxCare onboarded for version 11.0.26. The target code contains the complete fix: releaseHeader() and releaseChunk() helper methods that null buffer references after release, preventing double-release on exception paths in HEADER_OVERFLOW and NEED_CHUNK_TRAILER cases. The _chunk field was moved from class-level to SendCallback inner class scope, preventing cross-request buffer sharing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "CVE-2019-17638 (ByteBuffer double-release causing information disclosure) is NOT present in Jetty 11.0.33. The upstream fix (commit ff8ae56fa93 by gregw@webtide.com) was already included in the upstream release that TuxCare onboarded for version 11.0.26. The target code contains the complete fix: releaseHeader() and releaseChunk() helper methods that null buffer references after release, preventing double-release on exception paths in HEADER_OVERFLOW and NEED_CHUNK_TRAILER cases. The _chunk field was moved from class-level to SendCallback inner class scope, preventing cross-request buffer sharing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:37:28.336698+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 (GZIP request body inflation vulnerability causing unconsumed input to leak into subsequent requests) is NOT present in target version 11.0.33. The vulnerability was fixed by upstream commit cb10c35daf1 authored by Simone Bordet (simone.bordet@gmail.com), which was already included in the upstream Jetty release that TuxCare onboarded. The fix adds the ensureConsumeAllOrNotPersist...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 (GZIP request body inflation vulnerability causing unconsumed input to leak into subsequent requests) is NOT present in target version 11.0.33. The vulnerability was fixed by upstream commit cb10c35daf1 authored by Simone Bordet (simone.bordet@gmail.com), which was already included in the upstream Jetty release that TuxCare onboarded. The fix adds the ensureConsumeAllOrNotPersist..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:30:53.834927+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223 is NOT present in target Jetty 11.0.33. The vulnerability involved an inefficient O(n\u00b2) bubble-sort-like algorithm in QuotedQualityCSV that could cause DoS when processing HTTP headers with many quality parameters. The upstream fix (commit 10e531756b9) replaced this with an O(n log n) comparator-based sort using Java streams. This fix is present in the target and was authored by ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27223 is NOT present in target Jetty 11.0.33. The vulnerability involved an inefficient O(n\u00b2) bubble-sort-like algorithm in QuotedQualityCSV that could cause DoS when processing HTTP headers with many quality parameters. The upstream fix (commit 10e531756b9) replaced this with an O(n log n) comparator-based sort using Java streams. This fix is present in the target and was authored by ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:31:59.702907+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. Target version 11.0.33 is NOT AFFECTED by CVE-2021-28165. The vulnerability (infinite loop causing CPU exhaustion when processing oversized TLS frames) was fixed in upstream commit 039c7386d0f by Simone Bordet, which shipped in the upstream Jetty release before TuxCare onboarded version 11.0.26. The fix is present at SslConnection.java:756-760, where buffer capacity is checked before continuing the TLS unwrap loop, preventing the infinite loop condition. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "Target version 11.0.33 is NOT AFFECTED by CVE-2021-28165. The vulnerability (infinite loop causing CPU exhaustion when processing oversized TLS frames) was fixed in upstream commit 039c7386d0f by Simone Bordet, which shipped in the upstream Jetty release before TuxCare onboarded version 11.0.26. The fix is present at SslConnection.java:756-760, where buffer capacity is checked before continuing the TLS unwrap loop, preventing the infinite loop condition. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:25:18.094032+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2021-34428 is not present in Jetty 11.0.33.tuxcare0001. The upstream fix (commit 087f486b446 by Jan Bartel) was already included in the Jetty 11.0.26 release that TuxCare onboarded. The fix ensures session IDs are invalidated even when SessionListener.sessionDestroyed() throws exceptions, by wrapping listener calls in try-catch and placing the invalidateAll() call in a finally block. Code i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34428 is not present in Jetty 11.0.33.tuxcare0001. The upstream fix (commit 087f486b446 by Jan Bartel) was already included in the Jetty 11.0.26 release that TuxCare onboarded. The fix ensures session IDs are invalidated even when SessionListener.sessionDestroyed() throws exceptions, by wrapping listener calls in try-catch and placing the invalidateAll() call in a finally block. Code i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. The target repository (Jetty 11.0.33.tuxcare0001) is not affected by CVE-2022-2191. The vulnerability was a ByteBuffer memory leak when TLS handshake errors occurred. The fix (commit 66de7ba6180, dated 2022-06-15) was already present in upstream Jetty version 11.0.10. TuxCare onboarded version 11.0.26 (on 2025-12-12), which already contained this upstream fix. The fix adds buffer cleanup methods (discardInputBuffers, discardEncryptedOutputBuffer) that are called in all error paths to ensure ByteBuffers are properly released. The fix author is lorban@bitronix.be (not a TuxCare domain), confirming this is an upstream fix that shipped in the original release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "The target repository (Jetty 11.0.33.tuxcare0001) is not affected by CVE-2022-2191. The vulnerability was a ByteBuffer memory leak when TLS handshake errors occurred. The fix (commit 66de7ba6180, dated 2022-06-15) was already present in upstream Jetty version 11.0.10. TuxCare onboarded version 11.0.26 (on 2025-12-12), which already contained this upstream fix. The fix adds buffer cleanup methods (discardInputBuffers, discardEncryptedOutputBuffer) that are called in all error paths to ensure ByteBuffers are properly released. The fix author is lorban@bitronix.be (not a TuxCare domain), confirming this is an upstream fix that shipped in the original release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:47:27.495187+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty version 11.0.33.tuxcare0001 is not affected by CVE-2023-26048. The vulnerability, which allows attackers to cause OutOfMemoryError via multipart requests with parts lacking filename, was patched in upstream version 11.0.14 (February 2023). The target version 11.0.33 already contains the complete upstream fix authored by Lachlan Roberts from Webtide. The defense mechanisms are prese...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 Target Jetty version 11.0.33.tuxcare0001 is not affected by CVE-2023-26048. The vulnerability, which allows attackers to cause OutOfMemoryError via multipart requests with parts lacking filename, was patched in upstream version 11.0.14 (February 2023). The target version 11.0.33 already contains the complete upstream fix authored by Lachlan Roberts from Webtide. The defense mechanisms are prese..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:18:00.133256+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.33) is NOT AFFECTED by CVE-2023-26049 (cookie smuggling via semicolons in quoted values). The vulnerability was fixed by upstream commits 7b8c2c1bf08 and 1be1401bafb, which were already present in the upstream 11.0.26 release before TuxCare onboarded this version. The fix ensures that cookies containing semicolons within quoted values are marked as invalid and ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.33) is NOT AFFECTED by CVE-2023-26049 (cookie smuggling via semicolons in quoted values). The vulnerability was fixed by upstream commits 7b8c2c1bf08 and 1be1401bafb, which were already present in the upstream 11.0.26 release before TuxCare onboarded this version. The fix ensures that cookies containing semicolons within quoted values are marked as invalid and ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. The target Eclipse Jetty version 11.0.33.tuxcare0001 is NOT AFFECTED by CVE-2024-13009. The upstream fix for buffer mismanagement during gzip inflation errors was already present in the upstream release 11.0.26 before TuxCare onboarded the project. The fix commit (e3fa9466633) by Greg Wilkins ensures that content buffer references are properly nullified when interception errors occur, preventing buffer reuse across requests. The architectural refactoring in Jetty 11.x (ContentProducer pattern) implements this protection via the failCurrentContent() method in AsyncContentProducer, which sets _rawContent and _transformedContent to null when gzip errors occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "The target Eclipse Jetty version 11.0.33.tuxcare0001 is NOT AFFECTED by CVE-2024-13009. The upstream fix for buffer mismanagement during gzip inflation errors was already present in the upstream release 11.0.26 before TuxCare onboarded the project. The fix commit (e3fa9466633) by Greg Wilkins ensures that content buffer references are properly nullified when interception errors occur, preventing buffer reuse across requests. The architectural refactoring in Jetty 11.x (ContentProducer pattern) implements this protection via the failCurrentContent() method in AsyncContentProducer, which sets _rawContent and _transformedContent to null when gzip errors occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. Target version 11.0.33 is not affected by CVE-2024-7708. The memory leak vulnerability (buffers not released when HTTP body reading returns 0 bytes) was fixed in upstream Jetty 11.0.23 by commit 8259eabbc70, authored by Simone Bordet. This fix was already present in the upstream release before TuxCare onboarded version 11.0.26. The target code at HEAD (e2baecf7d37) contains the complete fix: releaseRequestBuffer() is called when fill returns \u22640 bytes (line 385) and in exception paths (line 401), preventing buffer leaks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "Target version 11.0.33 is not affected by CVE-2024-7708. The memory leak vulnerability (buffers not released when HTTP body reading returns 0 bytes) was fixed in upstream Jetty 11.0.23 by commit 8259eabbc70, authored by Simone Bordet. This fix was already present in the upstream release before TuxCare onboarded version 11.0.26. The target code at HEAD (e2baecf7d37) contains the complete fix: releaseRequestBuffer() is called when fill returns \u22640 bytes (line 385) and in exception paths (line 401), preventing buffer leaks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T01:37:47.366906+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T01:37:47.366906+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. Jetty 11.0.30 is outside the affected range (12.0.0\u201312.0.35 and 12.1.0\u201312.1.9). CVE-2026-10051 affects the Jetty 12 lifecycle where connection-scoped trailer state can survive parser reuse. This code path is absent in Jetty 11.0.30, where the HTTP channel clears its trailer state during request recycle before the parser is reused. Therefore, trailer state cannot leak between requests in this version.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "Jetty 11.0.30 is outside the affected range (12.0.0\u201312.0.35 and 12.1.0\u201312.1.9). CVE-2026-10051 affects the Jetty 12 lifecycle where connection-scoped trailer state can survive parser reuse. This code path is absent in Jetty 11.0.30, where the HTTP channel clears its trailer state during request recycle before the parser is reused. Therefore, trailer state cannot leak between requests in this version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T01:37:47.366906+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T01:37:47.366906+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T02:29:34.635822+00:00",
      "status_notes": "Vulnerability CVE-2026-18660 is fixed in version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-18660"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T01:37:47.366906+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T01:37:47.366906+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T01:37:47.366906+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T02:29:34.635822+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T02:29:34.635822+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T02:29:34.635822+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 11.0.33.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    }
  ]
}