{
  "@id": "urn:uuid:e89aa670-b05f-40ba-9197-74f2753b4030",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:29:48.390816+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:10:10.548488+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 affects Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3 where predictable session identifiers were generated using java.util.Random. The target repository (Jetty 11.0.34) uses SecureRandom for session ID generation by default, with only an exceptional fallback to Random. This fix was introduced by upstream Jetty in April 2010 (commit c3275730b91 by greg@webtide.com) and...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 affects Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3 where predictable session identifiers were generated using java.util.Random. The target repository (Jetty 11.0.34) uses SecureRandom for session ID generation by default, with only an exceptional fallback to Random. This fix was introduced by upstream Jetty in April 2010 (commit c3275730b91 by greg@webtide.com) and..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target (Jetty 11.0.34.tuxcare0001) is not affected by CVE-2011-4461. The vulnerability was fixed in upstream commit 085c79d7d6c (2011-12-30) which introduced the maxFormKeys limit to prevent hash collision DOS attacks on form parameters. This fix was already present in the upstream release 11.0.26 that TuxCare onboarded in December 2025. The defense is fully implemented and active by defaul...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 The target (Jetty 11.0.34.tuxcare0001) is not affected by CVE-2011-4461. The vulnerability was fixed in upstream commit 085c79d7d6c (2011-12-30) which introduced the maxFormKeys limit to prevent hash collision DOS attacks on form parameters. This fix was already present in the upstream release 11.0.26 that TuxCare onboarded in December 2025. The defense is fully implemented and active by defaul..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "action_statement": "Vulnerability CVE-2015-2080 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:33:21.899203+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, where path normalization in PathResource allowed bypassing protected resource restrictions via URLs with escaped backslashes. The vulnerability was fixed in upstream commit 97af3d663fd (May 2016) by Joakim Erdfelt. The fix enhances alias detection to catch Windows-specific path normalization issues by comparing the original URI ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, where path normalization in PathResource allowed bypassing protected resource restrictions via URLs with escaped backslashes. The vulnerability was fixed in upstream commit 97af3d663fd (May 2016) by Joakim Erdfelt. The fix enhances alias detection to catch Windows-specific path normalization issues by comparing the original URI ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "action_statement": "Vulnerability CVE-2017-7656 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "action_statement": "Vulnerability CVE-2017-7658 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T18:22:03.247224+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 042f325f, 2baa1abe, f3751d70). Version 11.0.34 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wfcc-pff6-rgc5 (affected up to 9.4.6.v20170531), NVD (affected up to 9.4.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 042f325f, 2baa1abe, f3751d70). Version 11.0.34 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wfcc-pff6-rgc5 (affected up to 9.4.6.v20170531), NVD (affected up to 9.4.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T10:41:28.069303+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 11.0.34 already contains the upstream fix for the CVE-2018-12536 pattern. ResourceContentFactory.getContent wraps any Throwable from resource loading in an InvalidPathException that carries only the request pathInContext. ResourceService catches that exception and answers 404, so the base directory path never reaches the error page. The fix is upstream work (author joakim.erdfelt@gmail.co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.34 already contains the upstream fix for the CVE-2018-12536 pattern. ResourceContentFactory.getContent wraps any Throwable from resource loading in an InvalidPathException that carries only the request pathInContext. ResourceService catches that exception and answers 404, so the base directory path never reaches the error page. The fix is upstream work (author joakim.erdfelt@gmail.co..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2018-12545 (HTTP/2 SETTINGS frame DoS) is NOT PRESENT in Jetty 11.0.34.tuxcare0001. The upstream fix (commit 9eca404da29 by Simone Bordet) shipped in the Jetty release before TuxCare's onboarding. The defense code exists at SettingsBodyParser.java:193-200, tracking cumulative settings keys and rejecting connections exceeding limit (default 64) with ENHANCE_YOUR_CALM_ERROR. The fix is active by default and protects against both attack vectors (large frames with many settings, many small frames).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 (HTTP/2 SETTINGS frame DoS) is NOT PRESENT in Jetty 11.0.34.tuxcare0001. The upstream fix (commit 9eca404da29 by Simone Bordet) shipped in the Jetty release before TuxCare's onboarding. The defense code exists at SettingsBodyParser.java:193-200, tracking cumulative settings keys and rejecting connections exceeding limit (default 64) with ENHANCE_YOUR_CALM_ERROR. The fix is active by default and protects against both attack vectors (large frames with many settings, many small frames).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T07:20:00.085500+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 11.0.34 already contains the upstream CVE-2019-10241 fix. The directory listing in Resource.getListHTML HTML-sanitizes the title and each entry name and escapes the href base. The fix commit (ca77bd384a2, Joakim Erdfelt) is in the upstream release that TuxCare onboarded, before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.34 already contains the upstream CVE-2019-10241 fix. The directory listing in Resource.getListHTML HTML-sanitizes the title and each entry name and escapes the href base. The fix commit (ca77bd384a2, Joakim Erdfelt) is in the upstream release that TuxCare onboarded, before the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T15:11:52.923350+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 affects Jetty servers configured to show directory listings, allowing disclosure of full server filesystem paths in the HTML response. The target repository (Jetty 11.0.34) contains the upstream fix (commit 7b774d82e82) which was already present in the upstream release 11.0.26 that TuxCare onboarded. The fix introduces a `getFileName()` method that properly extracts only the file...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 affects Jetty servers configured to show directory listings, allowing disclosure of full server filesystem paths in the HTML response. The target repository (Jetty 11.0.34) contains the upstream fix (commit 7b774d82e82) which was already present in the upstream release 11.0.26 that TuxCare onboarded. The fix introduces a `getFileName()` method that properly extracts only the file..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T07:20:00.085500+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 11.0.34 is not affected. DefaultHandler's 404 context listing prints only context path, display name, availability and lifecycle state. It never prints the resource base or any filesystem path. The upstream fix, commit d983890d, is already in the upstream release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.34 is not affected. DefaultHandler's 404 context listing prints only context path, display name, availability and lifecycle state. It never prints the resource base or any filesystem path. The upstream fix, commit d983890d, is already in the upstream release that TuxCare onboarded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:19:00.599819+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target (Jetty 11.0.34.tuxcare0001) is NOT affected by CVE-2019-17632. The vulnerability concerns unescaped exception messages in error pages leading to XSS. The fix (commits cf0df6e3ffd and 9e40fc9a6fb by Joakim Erdfelt) that sanitizes exception messages via StringUtil.sanitizeXmlString() was already present in upstream Jetty 11.0.26 when TuxCare onboarded this version (first TuxCare commit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 The target (Jetty 11.0.34.tuxcare0001) is NOT affected by CVE-2019-17632. The vulnerability concerns unescaped exception messages in error pages leading to XSS. The fix (commits cf0df6e3ffd and 9e40fc9a6fb by Joakim Erdfelt) that sanitizes exception messages via StringUtil.sanitizeXmlString() was already present in upstream Jetty 11.0.26 when TuxCare onboarded this version (first TuxCare commit..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. The target (Jetty 11.0.34-SNAPSHOT) is NOT affected by CVE-2019-17638. The vulnerability involved a double-release of ByteBuffer in the HEADER_OVERFLOW response path, allowing two threads to acquire the same buffer and causing response data cross-contamination between clients. The upstream fix (commit ff8ae56fa93 by gregw@webtide.com) was already present in Jetty 11.0.26 when TuxCare onboarded it. The fix ensures buffer references are nulled immediately after release, preventing double-release. The vulnerable pattern is completely absent from the current code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "The target (Jetty 11.0.34-SNAPSHOT) is NOT affected by CVE-2019-17638. The vulnerability involved a double-release of ByteBuffer in the HEADER_OVERFLOW response path, allowing two threads to acquire the same buffer and causing response data cross-contamination between clients. The upstream fix (commit ff8ae56fa93 by gregw@webtide.com) was already present in Jetty 11.0.26 when TuxCare onboarded it. The fix ensures buffer references are nulled immediately after release, preventing double-release. The vulnerable pattern is completely absent from the current code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:37:28.336698+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 affects Eclipse Jetty 9.4.x versions before 9.4.35 where GZIP request body inflation could cause unconsumed inflated data to leak into subsequent requests on the same connection. The target is Jetty 11.0.34, which has never been vulnerable to this issue. The fix (commit 14f94f738df) was created on November 18, 2020 and included in all Jetty 11.0.x releases starting from 11.0.0 (D...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 affects Eclipse Jetty 9.4.x versions before 9.4.35 where GZIP request body inflation could cause unconsumed inflated data to leak into subsequent requests on the same connection. The target is Jetty 11.0.34, which has never been vulnerable to this issue. The fix (commit 14f94f738df) was created on November 18, 2020 and included in all Jetty 11.0.x releases starting from 11.0.0 (D..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:30:53.834927+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223 describes a DoS vulnerability in Jetty's QuotedQualityCSV class where HTTP headers with many quality parameters cause CPU exhaustion due to inefficient O(n\u00b2+) sorting. The target (version 11.0.34.tuxcare0001) contains the upstream fix (commit 10e531756b9) that replaced the bubble-sort-like algorithm with comparator-based sorting. This fix was authored by upstream developer Joakim...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27223 describes a DoS vulnerability in Jetty's QuotedQualityCSV class where HTTP headers with many quality parameters cause CPU exhaustion due to inefficient O(n\u00b2+) sorting. The target (version 11.0.34.tuxcare0001) contains the upstream fix (commit 10e531756b9) that replaced the bubble-sort-like algorithm with comparator-based sorting. This fix was authored by upstream developer Joakim..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "action_statement": "Vulnerability CVE-2021-28165 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T07:22:00.065919+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target (Jetty 11.0.34 tuxcare) already contains the upstream fix for CVE-2021-34428 (Issue #6277, commit cd6462a6). Session.invalidate() catches exceptions from the destroy listeners and runs finishInvalidate() plus SessionIdManager.invalidateAll() in a finally block. The fix shipped in the upstream release, before the first TuxCare commit, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 Target (Jetty 11.0.34 tuxcare) already contains the upstream fix for CVE-2021-34428 (Issue #6277, commit cd6462a6). Session.invalidate() catches exceptions from the destroy listeners and runs finishInvalidate() plus SessionIdManager.invalidateAll() in a finally block. The fix shipped in the upstream release, before the first TuxCare commit, so the verdict is not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. The target repository (Jetty 11.0.34.tuxcare0001) is NOT AFFECTED by CVE-2022-2191. The upstream fix commit 66de7ba6180 (\"Improve ssl buffers handling #8165\") was already included in the Jetty 11.0.26+ release that TuxCare onboarded for Extended Lifecycle Support. The fix adds proper ByteBuffer cleanup (discardInputBuffers/discardEncryptedOutputBuffer) in error code paths of SslConnection to prevent memory leaks during TLS handshake errors. This fix was authored by Ludovic Orban (lorban@bitronix.be) and merged upstream before TuxCare's first commit (0856339822f \"setup 11.0.26\"). The vulnerable pattern was never present in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "The target repository (Jetty 11.0.34.tuxcare0001) is NOT AFFECTED by CVE-2022-2191. The upstream fix commit 66de7ba6180 (\"Improve ssl buffers handling #8165\") was already included in the Jetty 11.0.26+ release that TuxCare onboarded for Extended Lifecycle Support. The fix adds proper ByteBuffer cleanup (discardInputBuffers/discardEncryptedOutputBuffer) in error code paths of SslConnection to prevent memory leaks during TLS handshake errors. This fix was authored by Ludovic Orban (lorban@bitronix.be) and merged upstream before TuxCare's first commit (0856339822f \"setup 11.0.26\"). The vulnerable pattern was never present in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T07:28:00.058471+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The upstream fix for CVE-2023-26048 (Jetty PR #9344, backported to 11.x as c3021592218) is already in the shipped 11.0.34 tree. It adds a part-count limit (maxParts from maxFormKeys) and a cumulative limit on the size of filename-less parts (maxFormContentSize) in Request.getParts(). The fix was authored by upstream (lachlan@webtide.com) and predates the first TuxCare commit, so the verdict is ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for CVE-2023-26048 (Jetty PR #9344, backported to 11.x as c3021592218) is already in the shipped 11.0.34 tree. It adds a part-count limit (maxParts from maxFormKeys) and a cumulative limit on the size of filename-less parts (maxFormContentSize) in Request.getParts(). The fix was authored by upstream (lachlan@webtide.com) and predates the first TuxCare commit, so the verdict is ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T07:26:00.061897+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Not affected. The upstream fix for CVE-2023-26049 (Jetty commit 7b8c2c1bf08, PR #9339) is already in HEAD. It shipped in the upstream 11.0.26 release that TuxCare onboarded. In the default RFC6265 compliance mode, a cookie whose quoted value contains a semicolon is invalidated and dropped, so cookies cannot be smuggled inside another cookie's value.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2023-26049 (Jetty commit 7b8c2c1bf08, PR #9339) is already in HEAD. It shipped in the upstream 11.0.26 release that TuxCare onboarded. In the default RFC6265 compliance mode, a cookie whose quoted value contains a semicolon is invalidated and dropped, so cookies cannot be smuggled inside another cookie's value."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2024-13009 affects Jetty 9.4.0 to 9.4.56. The target is Jetty 11.0.34.tuxcare0001, which uses a fundamentally different content producer architecture. The vulnerable pattern (HttpInput._content not being nulled after gzip decompression errors) does not exist in Jetty 11. Jetty 11's AsyncContentProducer.failCurrentContent() has always nulled buffers (_rawContent and _transformedContent) after interceptor errors since the architecture's inception in March 2020 (commit 814dc69803f), years before CVE-2024-13009 was discovered. The CVE explicitly excludes Jetty 11+ from affected versions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "CVE-2024-13009 affects Jetty 9.4.0 to 9.4.56. The target is Jetty 11.0.34.tuxcare0001, which uses a fundamentally different content producer architecture. The vulnerable pattern (HttpInput._content not being nulled after gzip decompression errors) does not exist in Jetty 11. Jetty 11's AsyncContentProducer.failCurrentContent() has always nulled buffers (_rawContent and _transformedContent) after interceptor errors since the architecture's inception in March 2020 (commit 814dc69803f), years before CVE-2024-13009 was discovered. The CVE explicitly excludes Jetty 11+ from affected versions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2024-7708 memory leak vulnerability is NOT present in target version 11.0.34. The upstream fix (commit 8259eabbc70 by Simone Bordet) was already included in upstream release 11.0.26, which TuxCare onboarded at commit 0856339822f. The fix ensures request buffers are released when fill operations return \u22640 bytes or throw exceptions, preventing the memory leak described in the CVE. The target code at HttpConnection.fillRequestBuffer() contains the complete defense mechanism at lines 377-386 (releases buffer on filled\u22640) and 393-404 (releases buffer on exceptions).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "CVE-2024-7708 memory leak vulnerability is NOT present in target version 11.0.34. The upstream fix (commit 8259eabbc70 by Simone Bordet) was already included in upstream release 11.0.26, which TuxCare onboarded at commit 0856339822f. The fix ensures request buffers are released when fill operations return \u22640 bytes or throw exceptions, preventing the memory leak described in the CVE. The target code at HttpConnection.fillRequestBuffer() contains the complete defense mechanism at lines 377-386 (releases buffer on filled\u22640) and 393-404 (releases buffer on exceptions).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. Jetty 11.0.30 is outside the affected range (12.0.0\u201312.0.35 and 12.1.0\u201312.1.9). CVE-2026-10051 affects the Jetty 12 lifecycle where connection-scoped trailer state can survive parser reuse. This code path is absent in Jetty 11.0.30, where the HTTP channel clears its trailer state during request recycle before the parser is reused. Therefore, trailer state cannot leak between requests in this version.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "Jetty 11.0.30 is outside the affected range (12.0.0\u201312.0.35 and 12.1.0\u201312.1.9). CVE-2026-10051 affects the Jetty 12 lifecycle where connection-scoped trailer state can survive parser reuse. This code path is absent in Jetty 11.0.30, where the HTTP channel clears its trailer state during request recycle before the parser is reused. Therefore, trailer state cannot leak between requests in this version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-18660 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-18660"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:05:00.113792+00:00",
      "status_notes": "Vulnerability CVE-2026-95533 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-95533"
      }
    }
  ]
}