{ "@id": "urn:uuid:3faa6aa7-a2d8-4324-92bf-3388651fa4fb", "role": "Document Creator", "author": "https://tuxcare.com", "version": 20, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:05:51.407283+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-11-03T15:05:45.890515+00:00", "status_notes": "Vulnerability CVE-2006-6969 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 affects Jetty versions before 6.1.0pre3 due to predictable session ID generation using java.util.Random. The target version 9.2.16.v20160414 already contains the upstream fix committed in April 2010 (commit c3275730b913, documented in VERSION.txt for jetty-6.1.0pre3). The AbstractSessionIdManager.java uses SecureRandom by default with fallback to Random only in exceptional cases, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2006-6969" }, "impact_statement": "not_affected \u2014 CVE-2006-6969 affects Jetty versions before 6.1.0pre3 due to predictable session ID generation using java.util.Random. The target version 9.2.16.v20160414 already contains the upstream fix committed in April 2010 (commit c3275730b913, documented in VERSION.txt for jetty-6.1.0pre3). The AbstractSessionIdManager.java uses SecureRandom by default with fallback to Random only in exceptional cases, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2011-4461 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 is NOT present in Jetty 9.2.16.v20160414. The vulnerability (hash collision DoS from unlimited form parameters) was fixed in upstream commit 085c79d7d6c on Dec 30, 2011, which added maxFormKeys limit (default 1000) to form parameter parsing. This fix was already present in the upstream Jetty 9.2.16.v20160414 release (April 2016) that TuxCare onboarded. The defensive code is active...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-4461" }, "impact_statement": "not_affected \u2014 CVE-2011-4461 is NOT present in Jetty 9.2.16.v20160414. The vulnerability (hash collision DoS from unlimited form parameters) was fixed in upstream commit 085c79d7d6c on Dec 30, 2011, which added maxFormKeys limit (default 1000) to form parameter parsing. This fix was already present in the upstream Jetty 9.2.16.v20160414 release (April 2016) that TuxCare onboarded. The defensive code is active..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2015-2080 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2015-2080" }, "action_statement": "Vulnerability CVE-2015-2080 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-11-03T15:30:13.587550+00:00", "status_notes": "Vulnerability CVE-2016-4800 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target version (Jetty 9.2.16.v20160414-tuxcare.2) is NOT affected by CVE-2016-4800. While the CVE describes a path normalization vulnerability in the PathResource class affecting Jetty 9.3.x before 9.3.9, version 9.2.16 uses FileResource as the default for file:// URLs, and FileResource already contains the URI comparison defense (commit 31ce7cabdad from June 2014) that prevents the exploit...", "vulnerability": { "name": "CVE-2016-4800" }, "impact_statement": "not_affected \u2014 The target version (Jetty 9.2.16.v20160414-tuxcare.2) is NOT affected by CVE-2016-4800. While the CVE describes a path normalization vulnerability in the PathResource class affecting Jetty 9.3.x before 9.3.9, version 9.2.16 uses FileResource as the default for file:// URLs, and FileResource already contains the URI comparison defense (commit 31ce7cabdad from June 2014) that prevents the exploit..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2017-7656 is fixed in version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-7656" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2017-7657 is fixed in version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-7657" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2017-7658 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2017-7658. The fix was applied through the CVE-2017-7656 backport (commit 41af32dd6bd) on 2025-12-10. The same upstream patch (a285deea) fixed CVE-2017-7656, CVE-2017-7657, and CVE-2017-7658 together, as they all address HTTP Request Smuggling vulnerabilities in the HTTP parser. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7658" }, "impact_statement": "Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2017-7658. The fix was applied through the CVE-2017-7656 backport (commit 41af32dd6bd) on 2025-12-10. The same upstream patch (a285deea) fixed CVE-2017-7656, CVE-2017-7657, and CVE-2017-7658 together, as they all address HTTP Request Smuggling vulnerabilities in the HTTP parser. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2017-9735 is fixed in version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-9735" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2018-12536 is fixed in version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2018-12536" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2018-12538 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2018-12538" }, "action_statement": "Vulnerability CVE-2018-12538 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2018-12545 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2018-12545 targets HTTP/2 SETTINGS frame handling in Jetty 9.3.x and 9.4.x. The target version 9.2.16.v20160414 does not implement HTTP/2 - it only supports SPDY. HTTP/2 support was introduced in Jetty 9.3.0 (April 2015), but this version is from the 9.2.x branch released April 2016. Exhaustive searches found no HTTP/2 modules, classes, or parsers. The INPUT (HTTP/2 SETTINGS frames) specified in the CVE is not received in this codebase. While SPDY has similar SETTINGS frames with an unbounded count field (jetty-spdy/spdy-core/src/main/java/org/eclipse/jetty/spdy/parser/SettingsBodyParser.java:53), this is a different protocol not covered by CVE-2018-12545.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12545" }, "impact_statement": "CVE-2018-12545 targets HTTP/2 SETTINGS frame handling in Jetty 9.3.x and 9.4.x. The target version 9.2.16.v20160414 does not implement HTTP/2 - it only supports SPDY. HTTP/2 support was introduced in Jetty 9.3.0 (April 2015), but this version is from the 9.2.x branch released April 2016. Exhaustive searches found no HTTP/2 modules, classes, or parsers. The INPUT (HTTP/2 SETTINGS frames) specified in the CVE is not received in this codebase. While SPDY has similar SETTINGS frames with an unbounded count field (jetty-spdy/spdy-core/src/main/java/org/eclipse/jetty/spdy/parser/SettingsBodyParser.java:53), this is a different protocol not covered by CVE-2018-12545." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2019-10241 is fixed in version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2019-10241" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2019-10246 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2019-10246" }, "action_statement": "Vulnerability CVE-2019-10246 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:31:00.092678+00:00", "status_notes": "Vulnerability CVE-2019-10247 is fixed in version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2019-10247" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-11-02T19:15:00.519823+00:00", "status_notes": "Vulnerability CVE-2019-17632 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 describes a vulnerability where exception messages in stack traces are not escaped in error responses, enabling XSS attacks. However, this vulnerability was a REGRESSION introduced in Jetty 9.4.x branch (versions 9.4.21-23) after a code refactoring. The target version 9.2.16.v20160414 contains the original JETTY-1129 fix from 2009-2010 that prevents this XSS by capturing stack tr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17632" }, "impact_statement": "not_affected \u2014 CVE-2019-17632 describes a vulnerability where exception messages in stack traces are not escaped in error responses, enabling XSS attacks. However, this vulnerability was a REGRESSION introduced in Jetty 9.4.x branch (versions 9.4.21-23) after a code refactoring. The target version 9.2.16.v20160414 contains the original JETTY-1129 fix from 2009-2010 that prevents this XSS by capturing stack tr..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2019-17638 is fixed in version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2019-17638" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2020-27218 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 concerns GZIP request body inflation causing data leakage between multiplexed requests. Version 9.2.16.v20160414 does not contain any GZIP request body decompression functionality. Comprehensive analysis found no GZIPInputStream usage, no request Content-Encoding header handling, and no request body inflation code in any component. The GzipHandler only performs response compressi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27218" }, "impact_statement": "not_affected \u2014 CVE-2020-27218 concerns GZIP request body inflation causing data leakage between multiplexed requests. Version 9.2.16.v20160414 does not contain any GZIP request body decompression functionality. Comprehensive analysis found no GZIPInputStream usage, no request Content-Encoding header handling, and no request body inflation code in any component. The GzipHandler only performs response compressi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-11-09T13:56:04.082624+00:00", "status_notes": "Vulnerability CVE-2020-27223 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. Prechecker: no vulnerable code from the patch was found, and the file the fix changes (QuotedQualityCSV.java) does not exist in this version. Advisories: GitHub, NVD and Snyk list only newer lines as affected, so this version is older; the cve.org (Eclipse) record reads as affected only because its range has no lower end.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27223" }, "impact_statement": "Prechecker: no vulnerable code from the patch was found, and the file the fix changes (QuotedQualityCSV.java) does not exist in this version. Advisories: GitHub, NVD and Snyk list only newer lines as affected, so this version is older; the cve.org (Eclipse) record reads as affected only because its range has no lower end." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2021-28165 is fixed in version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2021-28165" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2021-34428 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2021-34428" }, "action_statement": "Vulnerability CVE-2021-34428 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-11-10T04:15:11.464324+00:00", "status_notes": "Vulnerability CVE-2022-2191 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its buffer pools do not retain acquired buffers, allowing unreleased buffers to be garbage-collected instead of causing persistent memory leakage. The pool contract explicitly permits omitted releases in jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:25, and jetty-io/src/main/java/org/eclipse/jetty/io/ArrayByteBufferPool.java:64 removes acquired buffers from the free queue, returning them only on release at line 84.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2022-2191" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its buffer pools do not retain acquired buffers, allowing unreleased buffers to be garbage-collected instead of causing persistent memory leakage. The pool contract explicitly permits omitted releases in jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:25, and jetty-io/src/main/java/org/eclipse/jetty/io/ArrayByteBufferPool.java:64 removes acquired buffers from the free queue, returning them only on release at line 84." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2023-26048 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2023-26048" }, "action_statement": "Vulnerability CVE-2023-26048 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2023-26049 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2023-26049" }, "action_statement": "Vulnerability CVE-2023-26049 affects version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2024-13009 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. Target version 9.2.16.v20160414 is not affected by CVE-2024-13009. The vulnerability exists in the HttpInput interceptor mechanism for gzip request body decompression, which was introduced in Jetty 9.4.x (October 2016) - six months AFTER this version. The target has no gzip request decompression capability and lacks the vulnerable code path entirely. CVE explicitly states affected versions are 9.4.0 to 9.4.56; target is 9.2.16 (before the affected range).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-13009" }, "impact_statement": "Target version 9.2.16.v20160414 is not affected by CVE-2024-13009. The vulnerability exists in the HttpInput interceptor mechanism for gzip request body decompression, which was introduced in Jetty 9.4.x (October 2016) - six months AFTER this version. The target has no gzip request decompression capability and lacks the vulnerable code path entirely. CVE explicitly states affected versions are 9.4.0 to 9.4.56; target is 9.2.16 (before the affected range)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-11-06T18:17:00.464761+00:00", "status_notes": "Vulnerability CVE-2024-7708 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. Prechecker: The functions the fix changes do not exist in this version. Version 9.2.16.v20160414 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-9299-c6m4-mjhc (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-7708" }, "impact_statement": "Prechecker: The functions the fix changes do not exist in this version. Version 9.2.16.v20160414 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-9299-c6m4-mjhc (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2024-8184 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository (Jetty 9.2.16.v20160414) is not vulnerable to CVE-2024-8184 because the vulnerable component ThreadLimitHandler.java does not exist in this version. ThreadLimitHandler was first introduced on 2016-09-08, approximately 5 months after the target repository's release date of 2016-04-14. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-8184" }, "impact_statement": "Version 9.2.16.v20160414 is not vulnerable. Summary: The target repository (Jetty 9.2.16.v20160414) is not vulnerable to CVE-2024-8184 because the vulnerable component ThreadLimitHandler.java does not exist in this version. ThreadLimitHandler was first introduced on 2016-09-08, approximately 5 months after the target repository's release date of 2016-04-14. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2026-10051 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 9.2.16.v20160414 does not implement HTTP trailer support. The CVE-2026-10051 vulnerability concerns trailer data leakage across keep-alive requests, but this version does not process trailers at all. The HttpParser has a TODO comment where trailer handling would be (line 1536), and no trailer-related fields, methods, or APIs exist in the server codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-10051" }, "impact_statement": "not_affected \u2014 Jetty 9.2.16.v20160414 does not implement HTTP trailer support. The CVE-2026-10051 vulnerability concerns trailer data leakage across keep-alive requests, but this version does not process trailers at all. The HttpParser has a TODO comment where trailer handling would be (line 1536), and no trailer-related fields, methods, or APIs exist in the server codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. Version 9.2.16.v20160414 is not vulnerable. Summary: Target repository (Jetty 9.2.16.v20160414) is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.0.5, while the target is running version 9.2.16 from April 2016. Additionally, the target version does not support HTTP request decompression, which is required for the vulnerability to manifest. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1605" }, "impact_statement": "Version 9.2.16.v20160414 is not vulnerable. Summary: Target repository (Jetty 9.2.16.v20160414) is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.0.5, while the target is running version 9.2.16 from April 2016. Additionally, the target version does not support HTTP request decompression, which is required for the vulnerability to manifest. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.2.16.v20160414-tuxcare.2" } } ], "timestamp": "2026-10-23T15:30:41.451202+00:00", "status_notes": "Vulnerability CVE-2026-6790 does not affect version 9.2.16.v20160414-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 9.2.16.v20160414 is not affected by CVE-2026-6790 because it does not implement HTTP/2 or HTTP/3, which are the protocols subject to this vulnerability. The CVE concerns mismatched :authority pseudo-header and Host header validation in HTTP/2 and HTTP/3 request processing. Jetty 9.2.16 predates widespread HTTP/2 adoption and contains only SPDY support (which uses :host, not :authority). H...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-6790" }, "impact_statement": "not_affected \u2014 Jetty 9.2.16.v20160414 is not affected by CVE-2026-6790 because it does not implement HTTP/2 or HTTP/3, which are the protocols subject to this vulnerability. The CVE concerns mismatched :authority pseudo-header and Host header validation in HTTP/2 and HTTP/3 request processing. Jetty 9.2.16 predates widespread HTTP/2 adoption and contains only SPDY support (which uses :host, not :authority). H..." } ] }