{
  "@id": "urn:uuid:f01cad5c-fdcd-4984-a011-d3e9fd779f2d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:06:44.318506+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:05:45.890515+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 concerns predictable session IDs generated using java.util.Random instead of SecureRandom. The target version 8.2.0.v20160908 uses SecureRandom for session ID generation by default (AbstractSessionIdManager.java:206). This upstream fix was introduced by commit c3275730b913 (April 2010, author greg@webtide.com) and was already present in the upstream release when TuxCare onboarded ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 concerns predictable session IDs generated using java.util.Random instead of SecureRandom. The target version 8.2.0.v20160908 uses SecureRandom for session ID generation by default (AbstractSessionIdManager.java:206). This upstream fix was introduced by commit c3275730b913 (April 2010, author greg@webtide.com) and was already present in the upstream release when TuxCare onboarded ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 affects Jetty 8.1.0.RC2 and earlier with hash collision DOS via unbounded form parameters. The target (Jetty 8.2.0.v20160908, released September 2016) already contains the upstream fix (commit 085c79d7d6c from December 2011) that adds maxFormKeys limit (default 1000) to prevent CPU exhaustion. The fix was authored by Greg Wilkins (gregw@webtide.com) and shipped in the upstream rel...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-4461 affects Jetty 8.1.0.RC2 and earlier with hash collision DOS via unbounded form parameters. The target (Jetty 8.2.0.v20160908, released September 2016) already contains the upstream fix (commit 085c79d7d6c from December 2011) that adds maxFormKeys limit (default 1000) to prevent CPU exhaustion. The fix was authored by Greg Wilkins (gregw@webtide.com) and shipped in the upstream rel..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 is a false positive for org.eclipse.jetty:jetty-server 8.2.0.v20160908-tuxcare.1. direct vulnerability is in Eclipse Jetty project - affected versions are 9.2.3.v20140905-9.2.8.v20150217, version 8.2.0.v20160908 is not in this range",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "direct vulnerability is in Eclipse Jetty project - affected versions are 9.2.3.v20140905-9.2.8.v20150217, version 8.2.0.v20160908 is not in this range"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T11:08:46.443689+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. Jetty 8.2.0.v20160908 is not affected. CVE-2016-4800 affects only Eclipse Jetty 9.3.0 through 9.3.8 (upstream advisory ocert-2016-001 / GHSA-872g-2h8h-362q: affected >= 9.3.0, <= 9.3.8, fixed in 9.3.9 by commit 97af3d663fd \"Improve Resource.getAlias() checks on Windows\"). The flaw is in the Windows path-alias check of PathResource, which became the default file Resource in 9.3.0. Jetty 8.2 has no PathResource class at all: Resource.newResource() always creates FileResource for file: URLs, so the vulnerable code is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "Jetty 8.2.0.v20160908 is not affected. CVE-2016-4800 affects only Eclipse Jetty 9.3.0 through 9.3.8 (upstream advisory ocert-2016-001 / GHSA-872g-2h8h-362q: affected >= 9.3.0, <= 9.3.8, fixed in 9.3.9 by commit 97af3d663fd \"Improve Resource.getAlias() checks on Windows\"). The flaw is in the Windows path-alias check of PathResource, which became the default file Resource in 9.3.0. Jetty 8.2 has no PathResource class at all: Resource.newResource() always creates FileResource for file: URLs, so the vulnerable code is not present."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server, and is fixed in 8.2.0.v20160908-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "action_statement": "Vulnerability CVE-2017-7656 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server, and is fixed in 8.2.0.v20160908-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server, and is fixed in 8.2.0.v20160908-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server, and is fixed in 8.2.0.v20160908-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server, and is fixed in 8.2.0.v20160908-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "action_statement": "Vulnerability CVE-2017-7658 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server, and is fixed in 8.2.0.v20160908-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 is fixed in version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-9735"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "action_statement": "Vulnerability CVE-2018-12536 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. Target version 8.2.0.v20160908 does not contain HTTP/2 protocol support, which was introduced in Jetty 9.3.0. CVE-2018-12545 affects HTTP/2 SETTINGS frame processing in versions 9.3.x and 9.4.x. The target only has SPDY support (jetty-spdy module), but the vulnerability is HTTP/2-specific. All security patches for this CVE modified jetty-http2 code exclusively. SPDY was deprecated and removed from Jetty in early 2018, before the CVE-2018-12545 patches were applied in 2019, confirming the vulnerability is HTTP/2-only.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "Target version 8.2.0.v20160908 does not contain HTTP/2 protocol support, which was introduced in Jetty 9.3.0. CVE-2018-12545 affects HTTP/2 SETTINGS frame processing in versions 9.3.x and 9.4.x. The target only has SPDY support (jetty-spdy module), but the vulnerability is HTTP/2-specific. All security patches for this CVE modified jetty-http2 code exclusively. SPDY was deprecated and removed from Jetty in early 2018, before the CVE-2018-12545 patches were applied in 2019, confirming the vulnerability is HTTP/2-only."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "action_statement": "Vulnerability CVE-2019-10241 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 Version 8.2.0.v20160908 is NOT affected by CVE-2019-10246. The vulnerable code pattern (iterating over Resource[] items and calling getName() which returns absolute paths) does not exist in this version. Version 8.2.0 uses a different architecture where directory listings iterate over String[] from File.list() which returns only filenames, never exposing full filesystem paths. The vulnerability...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 Version 8.2.0.v20160908 is NOT affected by CVE-2019-10246. The vulnerable code pattern (iterating over Resource[] items and calling getName() which returns absolute paths) does not exist in this version. Version 8.2.0 uses a different architecture where directory listings iterate over String[] from File.list() which returns only filenames, never exposing full filesystem paths. The vulnerability..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 is fixed in version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2019-10247"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T19:15:00.519823+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 affects Eclipse Jetty versions 9.4.21-23 specifically due to a regression where exception stack traces were output directly without HTML escaping. The target version 8.2.0.v20160908 (from 2016) never had this regression. The target code already contains the defense mechanism: it captures stack traces in a StringWriter and passes them through a write() method that escapes HTML spe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 affects Eclipse Jetty versions 9.4.21-23 specifically due to a regression where exception stack traces were output directly without HTML escaping. The target version 8.2.0.v20160908 (from 2016) never had this regression. The target code already contains the defense mechanism: it captures stack traces in a StringWriter and passes them through a write() method that escapes HTML spe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. CVE-2019-17638 is a double release of the pooled response-header ByteBuffer in Jetty's HTTP/1 server connection. It requires the code path introduced in Jetty 9.4.27.v20200227, where org.eclipse.jetty.server.HttpConnection's SendCallback reacts to the generator's HEADER_OVERFLOW result for an over-long response header by releasing the header buffer back to the ByteBufferPool and then throwing to produce the HTTP 431, leaving the field set so the connection's cleanup releases the same buffer again. Two threads then acquire one buffer from the pool and a client receives another client's response data. Upstream removed the second release in 9.4.30.v20200611 by checking the buffer capacity before releasing and by nulling the reference in a dedicated release helper. Jetty 8.2.0.v20160908 predates that architecture. Its jetty-server module contains no HttpConnection class, no SendCallback, no HEADER_OVERFLOW generator state and no org.eclipse.jetty.io.ByteBufferPool; responses are generated by org.eclipse.jetty.http.HttpGenerator/AbstractGenerator over the org.eclipse.jetty.io.Buffers pool, and org.eclipse.jetty.http.HttpStatus does not define status 431 at all. On this version an over-long response header surfaces as an ArrayIndexOutOfBoundsException that HttpGenerator.completeHeader rethrows as a RuntimeException; AbstractHttpConnection.commitResponse and completeResponse catch it, call _generator.reset() - which merely clears the existing header buffer and keeps it - and write a 500 response into that same buffer. No buffer is returned to the pool anywhere on that path. The pool is touched only by AbstractGenerator.returnBuffers(), which returns the header and content buffers under a length()==0 guard and nulls each field in the same block, so a buffer that has been returned cannot be returned a second time. The double release the vulnerability depends on has no counterpart in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "CVE-2019-17638 is a double release of the pooled response-header ByteBuffer in Jetty's HTTP/1 server connection. It requires the code path introduced in Jetty 9.4.27.v20200227, where org.eclipse.jetty.server.HttpConnection's SendCallback reacts to the generator's HEADER_OVERFLOW result for an over-long response header by releasing the header buffer back to the ByteBufferPool and then throwing to produce the HTTP 431, leaving the field set so the connection's cleanup releases the same buffer again. Two threads then acquire one buffer from the pool and a client receives another client's response data. Upstream removed the second release in 9.4.30.v20200611 by checking the buffer capacity before releasing and by nulling the reference in a dedicated release helper. Jetty 8.2.0.v20160908 predates that architecture. Its jetty-server module contains no HttpConnection class, no SendCallback, no HEADER_OVERFLOW generator state and no org.eclipse.jetty.io.ByteBufferPool; responses are generated by org.eclipse.jetty.http.HttpGenerator/AbstractGenerator over the org.eclipse.jetty.io.Buffers pool, and org.eclipse.jetty.http.HttpStatus does not define status 431 at all. On this version an over-long response header surfaces as an ArrayIndexOutOfBoundsException that HttpGenerator.completeHeader rethrows as a RuntimeException; AbstractHttpConnection.commitResponse and completeResponse catch it, call _generator.reset() - which merely clears the existing header buffer and keeps it - and write a 500 response into that same buffer. No buffer is returned to the pool anywhere on that path. The pool is touched only by AbstractGenerator.returnBuffers(), which returns the header and content buffers under a length()==0 guard and nulls each field in the same block, so a buffer that has been returned cannot be returned a second time. The double release the vulnerability depends on has no counterpart in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 8.2.0.v20160908 does not contain GZIP request body inflation functionality. CVE-2020-27218 affects Jetty versions with GzipHandler request inflation capability, which was first implemented in March 2019 (commit c1f6f6b6082) for Jetty 9.4.x, 2.5 years after this version was released. The target version only supports GZIP response compression, not request decompression, making the vulnerabi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 Jetty 8.2.0.v20160908 does not contain GZIP request body inflation functionality. CVE-2020-27218 affects Jetty versions with GzipHandler request inflation capability, which was first implemented in March 2019 (commit c1f6f6b6082) for Jetty 9.4.x, 2.5 years after this version was released. The target version only supports GZIP response compression, not request decompression, making the vulnerabi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T13:55:55.755322+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. Prechecker: no vulnerable code from the patch was found, and none of the identifiers of the vulnerable code exist in this version. Advisories: GitHub, NVD and Snyk list only newer lines as affected, so this version is older; the cve.org (Eclipse) record reads as affected only because its range has no lower end.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "Prechecker: no vulnerable code from the patch was found, and none of the identifiers of the vulnerable code exist in this version. Advisories: GitHub, NVD and Snyk list only newer lines as affected, so this version is older; the cve.org (Eclipse) record reads as affected only because its range has no lower end."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T14:55:10.536690+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "action_statement": "Vulnerability CVE-2021-28165 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 is fixed in version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T20:55:00.104909+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. TLS connections reach the project\u2019s own SslConnection through the connector (SslSelectChannelConnector.java:552). Its three handshake buffers are ordinary heap-backed IndirectNIOBuffers (SslConnection.java:80, IndirectNIOBuffer.java:30). Allocation takes one cached buffer set and clears the ThreadLocal reference, leaving ownership with the connection (SslConnection.java:144). Release caches only empty buffers, with at most one set per thread; nonempty buffers remain connection-owned (SslConnection.java:157). Both wrap and unwrap close the endpoint on SSLException (SslConnection.java:480, SslConnection.java:571). Endpoint closure schedules selector cleanup, which cancels the key and removes the endpoint from the registry (SelectChannelEndPoint.java:773, SelectChannelEndPoint.java:667, SelectorManager.java:850).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. TLS connections reach the project\u2019s own SslConnection through the connector (SslSelectChannelConnector.java:552). Its three handshake buffers are ordinary heap-backed IndirectNIOBuffers (SslConnection.java:80, IndirectNIOBuffer.java:30). Allocation takes one cached buffer set and clears the ThreadLocal reference, leaving ownership with the connection (SslConnection.java:144). Release caches only empty buffers, with at most one set per thread; nonempty buffers remain connection-owned (SslConnection.java:157). Both wrap and unwrap close the endpoint on SSLException (SslConnection.java:480, SslConnection.java:571). Endpoint closure schedules selector cleanup, which cancels the key and removes the endpoint from the registry (SelectChannelEndPoint.java:773, SelectChannelEndPoint.java:667, SelectorManager.java:850)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server, and is fixed in 8.2.0.v20160908-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "action_statement": "Vulnerability CVE-2023-26048 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server, and is fixed in 8.2.0.v20160908-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server, and is fixed in 8.2.0.v20160908-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "action_statement": "Vulnerability CVE-2023-26049 affects version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server, and is fixed in 8.2.0.v20160908-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. Target version 8.2.0.v20160908 is NOT AFFECTED by CVE-2024-13009. The vulnerability requires the Interceptor-based gzip request body decompression architecture and Content buffer lifecycle management introduced in Jetty 9.4.x. Version 8.2.0 uses a fundamentally different architecture: HttpInput is a simple 75-line class with no _content field, no Interceptor mechanism, and no support for gzip-compressed request bodies. Exhaustive searches confirmed the INPUT (gzip-compressed HTTP request bodies) is not processed anywhere in version 8.2.0. The vulnerable pattern cannot exist in this architecture.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "Target version 8.2.0.v20160908 is NOT AFFECTED by CVE-2024-13009. The vulnerability requires the Interceptor-based gzip request body decompression architecture and Content buffer lifecycle management introduced in Jetty 9.4.x. Version 8.2.0 uses a fundamentally different architecture: HttpInput is a simple 75-line class with no _content field, no Interceptor mechanism, and no support for gzip-compressed request bodies. Exhaustive searches confirmed the INPUT (gzip-compressed HTTP request bodies) is not processed anywhere in version 8.2.0. The vulnerable pattern cannot exist in this architecture."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:20:00.095414+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 8.2.0.v20160908 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-9299-c6m4-mjhc (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 8.2.0.v20160908 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-9299-c6m4-mjhc (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. Version 8.2.0.v20160908 is not vulnerable. Summary: The target repository (Jetty 8.2.0.v20160908) does not contain the ThreadLimitHandler class that is affected by CVE-2024-8184. This vulnerability is specific to ThreadLimitHandler.getRemote() which was introduced in later versions of Jetty (likely 9.4.x or later). Since the vulnerable component does not exist in this older version, the target is not affected by this CVE. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 8.2.0.v20160908 is not vulnerable. Summary: The target repository (Jetty 8.2.0.v20160908) does not contain the ThreadLimitHandler class that is affected by CVE-2024-8184. This vulnerability is specific to ThreadLimitHandler.getRemote() which was introduced in later versions of Jetty (likely 9.4.x or later). Since the vulnerable component does not exist in this older version, the target is not affected by this CVE. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 8.2.0 does not support HTTP trailers at all, so the trailer cross-request leakage vulnerability cannot manifest. The HttpParser immediately completes message processing upon encountering the final chunk without parsing the trailer-part section, and no trailer-related fields, methods, or APIs exist in the codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 8.2.0 does not support HTTP trailers at all, so the trailer cross-request leakage vulnerability cannot manifest. The HttpParser immediately completes message processing upon encountering the final chunk without parsing the trailer-part section, and no trailer-related fields, methods, or APIs exist in the codebase."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. Version 8.2.0.v20160908 is not vulnerable. Summary: Target repository is Jetty 8.2.0.v20160908, which does not have the HTTP request decompression feature that contains CVE-2026-1605. The vulnerability only affects Jetty 12.0.0-12.0.31 and 12.1.0-12.1.5. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 8.2.0.v20160908 is not vulnerable. Summary: Target repository is Jetty 8.2.0.v20160908, which does not have the HTTP request decompression feature that contains CVE-2026-1605. The vulnerability only affects Jetty 12.0.0-12.0.31 and 12.1.0-12.1.5. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@8.2.0.v20160908-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 does not affect version 8.2.0.v20160908-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 8.2.0.v20160908 does not implement HTTP/2 or HTTP/3, which are required to receive the CVE's attack INPUT (HTTP/2 or HTTP/3 request with mismatched :authority and Host headers). The target only supports HTTP/1.1 and SPDY (v2 and v3). SPDY uses :host pseudo-header, not :authority, and is architecturally different from HTTP/2. The vulnerability cannot manifest in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "impact_statement": "not_affected \u2014 Jetty 8.2.0.v20160908 does not implement HTTP/2 or HTTP/3, which are required to receive the CVE's attack INPUT (HTTP/2 or HTTP/3 request with mismatched :authority and Host headers). The target only supports HTTP/1.1 and SPDY (v2 and v3). SPDY uses :host pseudo-header, not :authority, and is architecturally different from HTTP/2. The vulnerability cannot manifest in this version."
    }
  ]
}