{
  "@id": "urn:uuid:714745f6-676b-4f71-94de-61d0fe7cc11d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:03:12.180165+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 concerns predictable session identifiers generated using java.util.Random in older Jetty versions (before 4.2.27, 5.1.12, 6.0.2, 6.1.0pre3). Jetty version 9.4.41.v20210516 is NOT affected because the vulnerability was fixed upstream in 2009 by replacing java.util.Random with SecureRandom as the default random number generator for session ID generation. The fix (commit da627b843fe8...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 concerns predictable session identifiers generated using java.util.Random in older Jetty versions (before 4.2.27, 5.1.12, 6.0.2, 6.1.0pre3). Jetty version 9.4.41.v20210516 is NOT affected because the vulnerability was fixed upstream in 2009 by replacing java.util.Random with SecureRandom as the default random number generator for session ID generation. The fix (commit da627b843fe8..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 9.4.41.v20210516 is not affected by CVE-2011-4461. The vulnerability (unbounded form parameter parsing enabling hash collision DoS) was fixed by upstream Jetty developer Greg Wilkins in commit 085c79d7d6c (2011-12-30), which added maxFormKeys limits (default 1000). This fix shipped in the upstream release before TuxCare onboarded the 9.4.41.v20210516 version. The defense mechanis...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 Target version 9.4.41.v20210516 is not affected by CVE-2011-4461. The vulnerability (unbounded form parameter parsing enabling hash collision DoS) was fixed by upstream Jetty developer Greg Wilkins in commit 085c79d7d6c (2011-12-30), which added maxFormKeys limits (default 1000). This fix shipped in the upstream release before TuxCare onboarded the 9.4.41.v20210516 version. The defense mechanis..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:45:44.119017+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 9.4.41.v20210516 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 9.4.41.v20210516 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:29:31.146838+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 describes a path normalization vulnerability in Jetty 9.3.x before 9.3.9 where escaped backslashes (%5C) could bypass security constraints on Windows. The fix from upstream commit 97af3d663fd (2016-05-13) is present in target version 9.4.41. The defense mechanism consists of: (1) PathResource private constructor that calculates URI and filesystem Path separately, (2) URIUtil.addPa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 describes a path normalization vulnerability in Jetty 9.3.x before 9.3.9 where escaped backslashes (%5C) could bypass security constraints on Windows. The fix from upstream commit 97af3d663fd (2016-05-13) is present in target version 9.4.41. The defense mechanism consists of: (1) PathResource private constructor that calculates URI and filesystem Path separately, (2) URIUtil.addPa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:37:16.972133+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. The target repository (Jetty 9.4.41.v20210516) already contains the fix for CVE-2017-7656. The vulnerable pattern (unvalidated HTTP header parsing that allows multiple Content-Length headers or Content-Length combined with Transfer-Encoding: chunked) is not present. The fix was implemented by upstream Jetty in commit a285deea42f (May 2018) by Greg Wilkins and was already included in the 9.4.41.v20210516 release (May 2021) that TuxCare onboarded. By default, the HttpParser uses RFC7230 compliance mode which enables protections against HTTP request smuggling via the MULTIPLE_CONTENT_LENGTHS and TRANSFER_ENCODING_WITH_CONTENT_LENGTH compliance sections. The vulnerable unvalidated parsing code has been replaced with validated parsing that rejects malicious header combinations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "The target repository (Jetty 9.4.41.v20210516) already contains the fix for CVE-2017-7656. The vulnerable pattern (unvalidated HTTP header parsing that allows multiple Content-Length headers or Content-Length combined with Transfer-Encoding: chunked) is not present. The fix was implemented by upstream Jetty in commit a285deea42f (May 2018) by Greg Wilkins and was already included in the 9.4.41.v20210516 release (May 2021) that TuxCare onboarded. By default, the HttpParser uses RFC7230 compliance mode which enables protections against HTTP request smuggling via the MULTIPLE_CONTENT_LENGTHS and TRANSFER_ENCODING_WITH_CONTENT_LENGTH compliance sections. The vulnerable unvalidated parsing code has been replaced with validated parsing that rejects malicious header combinations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2017-7658 HTTP Request Smuggling vulnerability is NOT present in target version 9.4.41.v20210516. The upstream fix (commit a285deea42f by Greg Wilkins) was already included in the upstream release before TuxCare onboarded it. The fix adds validation to reject HTTP requests with duplicate Content-Length headers or both Content-Length and Transfer-Encoding: chunked headers, preventing request smuggling attacks. The protections are active by default via RFC7230 compliance mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "CVE-2017-7658 HTTP Request Smuggling vulnerability is NOT present in target version 9.4.41.v20210516. The upstream fix (commit a285deea42f by Greg Wilkins) was already included in the upstream release before TuxCare onboarded it. The fix adds validation to reject HTTP requests with duplicate Content-Length headers or both Content-Length and Transfer-Encoding: chunked headers, preventing request smuggling attacks. The protections are active by default via RFC7230 compliance mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:25:55.953386+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2017-9735 (timing channel attack in password comparison) is NOT present in this target. The upstream fix was already included in Jetty 9.4.41.v20210516 when TuxCare onboarded it. The vulnerability was fixed upstream in May 2017 (commits 042f325, f3751d7, 2baa1ab by Simone Bordet), while the target version was released in May 2021, naturally including fixes from 4 years prior. All password/credential comparisons use constant-time methods (stringEquals/byteEquals) that prevent timing attacks by taking the same execution time regardless of where mismatches occur or password length differences.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 (timing channel attack in password comparison) is NOT present in this target. The upstream fix was already included in Jetty 9.4.41.v20210516 when TuxCare onboarded it. The vulnerability was fixed upstream in May 2017 (commits 042f325, f3751d7, 2baa1ab by Simone Bordet), while the target version was released in May 2021, naturally including fixes from 4 years prior. All password/credential comparisons use constant-time methods (stringEquals/byteEquals) that prevent timing attacks by taking the same execution time regardless of where mismatches occur or password length differences.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T17:56:00.216684+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 describes a path disclosure vulnerability where HTTP requests with invalid characters (e.g., control characters like %0a) trigger java.nio.file.InvalidPathException during static file serving in DefaultServlet. The exception message contains the full server filesystem path, which is then exposed in error responses. The target repository contains the upstream fix from commits 65de...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 describes a path disclosure vulnerability where HTTP requests with invalid characters (e.g., control characters like %0a) trigger java.nio.file.InvalidPathException during static file serving in DefaultServlet. The exception message contains the full server filesystem path, which is then exposed in error responses. The target repository contains the upstream fix from commits 65de..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "action_statement": "Vulnerability CVE-2018-12545 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:58:27.077017+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 9.4.41.v20210516) is NOT AFFECTED by CVE-2019-10241. The vulnerability affected older versions (9.4.15 and earlier) where directory listings did not properly sanitize filenames, allowing XSS injection. The target contains the complete upstream fix from April 2019 (commits ca77bd384a2 and 1565b5f160e) that applies HTML entity encoding via deTag() and URL encoding via...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 9.4.41.v20210516) is NOT AFFECTED by CVE-2019-10241. The vulnerability affected older versions (9.4.15 and earlier) where directory listings did not properly sanitize filenames, allowing XSS injection. The target contains the complete upstream fix from April 2019 (commits ca77bd384a2 and 1565b5f160e) that applies HTML entity encoding via deTag() and URL encoding via..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository is NOT AFFECTED by CVE-2019-10246. The vulnerability (exposure of fully qualified filesystem paths in directory listings on Windows) was fixed by upstream Eclipse Jetty in commit 3d028ab2ca7 (2019-04-15), which was already included in version 9.4.41.v20210516 before TuxCare onboarded the repository (2025-09-08). The vulnerable code pattern has been replaced with a secure i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 The target repository is NOT AFFECTED by CVE-2019-10246. The vulnerability (exposure of fully qualified filesystem paths in directory listings on Windows) was fixed by upstream Eclipse Jetty in commit 3d028ab2ca7 (2019-04-15), which was already included in version 9.4.41.v20210516 before TuxCare onboarded the repository (2025-09-08). The vulnerable code pattern has been replaced with a secure i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T16:22:00.147449+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 is not present in target version 9.4.41.v20210516. The vulnerability involved information disclosure of configured base resource directory paths through DefaultHandler's 404 error response via context.toString() calls. The upstream fix (commit 04c994712c0, dated 2019-04-15) removed these calls and was first released in Jetty 9.4.17. The target version 9.4.41 (released May 2021) a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 is not present in target version 9.4.41.v20210516. The vulnerability involved information disclosure of configured base resource directory paths through DefaultHandler's 404 error response via context.toString() calls. The upstream fix (commit 04c994712c0, dated 2019-04-15) removed these calls and was first released in Jetty 9.4.17. The target version 9.4.41 (released May 2021) a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T19:13:00.079692+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 affects Jetty versions 9.4.21-23 where exception messages in error pages were not HTML-escaped, enabling XSS attacks. The target version 9.4.41.v20210516 (May 2021) already contains the upstream fix from November 2019. The fix was authored by Eclipse Jetty maintainer Joakim Erdfelt and was present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unescape...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 affects Jetty versions 9.4.21-23 where exception messages in error pages were not HTML-escaped, enabling XSS attacks. The target version 9.4.41.v20210516 (May 2021) already contains the upstream fix from November 2019. The fix was authored by Eclipse Jetty maintainer Joakim Erdfelt and was present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unescape..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. Target version 9.4.41.v20210516 is NOT AFFECTED. The vulnerability CVE-2019-17638 (double-release of ByteBuffer causing response data leakage between clients) was fixed in upstream Jetty commit ff8ae56fa93 (June 2020) by author Greg Wilkins. This fix was already included in the upstream release 9.4.41.v20210516 that TuxCare later onboarded. The vulnerable double-release pattern does not exist in the target code - the fix reorders HEADER_OVERFLOW logic to check capacity before releasing buffers and adds helper methods that null references after release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "Target version 9.4.41.v20210516 is NOT AFFECTED. The vulnerability CVE-2019-17638 (double-release of ByteBuffer causing response data leakage between clients) was fixed in upstream Jetty commit ff8ae56fa93 (June 2020) by author Greg Wilkins. This fix was already included in the upstream release 9.4.41.v20210516 that TuxCare later onboarded. The vulnerable double-release pattern does not exist in the target code - the fix reorders HEADER_OVERFLOW logic to check capacity before releasing buffers and adds helper methods that null references after release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T19:32:48.041601+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 (Issue #5605 - unconsumed input on sendError) is NOT present in Jetty 9.4.41.v20210516. The vulnerability allowed unconsumed GZIP-compressed request body data to leak into subsequent requests on persistent HTTP connections. The upstream fix, authored by Greg Wilkins (gregw@webtide.com) and other Jetty maintainers, was already present in the upstream release (November 2020) before...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 (Issue #5605 - unconsumed input on sendError) is NOT present in Jetty 9.4.41.v20210516. The vulnerability allowed unconsumed GZIP-compressed request body data to leak into subsequent requests on persistent HTTP connections. The upstream fix, authored by Greg Wilkins (gregw@webtide.com) and other Jetty maintainers, was already present in the upstream release (November 2020) before..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T19:25:14.724252+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223: Target version 9.4.41.v20210516 is NOT AFFECTED. The vulnerable quadratic sorting algorithm in QuotedQualityCSV has been replaced with an efficient O(n log n) comparator-based sort. The fix was applied by upstream Jetty developer Joakim Erdfelt in commit 10e531756b9 (released in Jetty 9.4.37.v20210219) and was already present in the upstream release when TuxCare onboarded versio...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27223: Target version 9.4.41.v20210516 is NOT AFFECTED. The vulnerable quadratic sorting algorithm in QuotedQualityCSV has been replaced with an efficient O(n log n) comparator-based sort. The fix was applied by upstream Jetty developer Joakim Erdfelt in commit 10e531756b9 (released in Jetty 9.4.37.v20210219) and was already present in the upstream release when TuxCare onboarded versio..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:22:29.685630+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2021-28165 is not present in the target. The vulnerability (infinite loop causing CPU exhaustion when processing invalid large TLS frames >17408 bytes) was fixed by upstream Jetty in version 9.4.39.v20210325. The target version (9.4.41.v20210516) already contains the complete upstream fix. The defense code at jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java:736-740 checks for buffer space exhaustion and throws SSLHandshakeException to prevent the infinite loop. Fix attributed to upstream author Simone Bordet (commit 294b2ba02b66, 2021-03-22), present in the release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "CVE-2021-28165 is not present in the target. The vulnerability (infinite loop causing CPU exhaustion when processing invalid large TLS frames >17408 bytes) was fixed by upstream Jetty in version 9.4.39.v20210325. The target version (9.4.41.v20210516) already contains the complete upstream fix. The defense code at jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java:736-740 checks for buffer space exhaustion and throws SSLHandshakeException to prevent the infinite loop. Fix attributed to upstream author Simone Bordet (commit 294b2ba02b66, 2021-03-22), present in the release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "action_statement": "Vulnerability CVE-2021-34428 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:15:11.464324+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its default buffer pool does not retain acquired buffers, allowing garbage collection after failed connections close. Acquisition removes buffers from the pool without tracking them as active (jetty-io/src/main/java/org/eclipse/jetty/io/ArrayByteBufferPool.java:109-119). Both fill and flush failures close the connection (jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java:826-829, 1161-1164), so missed buffer returns reduce reuse without causing persistent retention.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its default buffer pool does not retain acquired buffers, allowing garbage collection after failed connections close. Acquisition removes buffers from the pool without tracking them as active (jetty-io/src/main/java/org/eclipse/jetty/io/ArrayByteBufferPool.java:109-119). Both fill and flush failures close the connection (jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java:826-829, 1161-1164), so missed buffer returns reduce reuse without causing persistent retention."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "action_statement": "Vulnerability CVE-2023-26048 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2023-26049"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "action_statement": "Vulnerability CVE-2024-13009 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:55:27.082072+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. A zero-byte fill leaves the buffer temporarily held in `_requestBuffer` (HttpConnection.java:340). Both callers then execute `parseRequestBuffer()` before their zero-read exits (HttpConnection.java:260, HttpConnection.java:322), including the body-input route (HttpInputOverHTTP.java:33). Filling rejects outstanding content references, and empty-buffer parsing cannot emit content because the content loop requires remaining bytes (HttpConnection.java:332, HttpParser.java:1653, HttpParser.java:1676). Consequently, parsing releases the empty buffer, nulls the connection field, and returns it to the pool (HttpConnection.java:382, HttpConnection.java:224). This complete fill-then-parse cleanup prevents the described leak despite the missing upstream in-fill release statement.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. A zero-byte fill leaves the buffer temporarily held in `_requestBuffer` (HttpConnection.java:340). Both callers then execute `parseRequestBuffer()` before their zero-read exits (HttpConnection.java:260, HttpConnection.java:322), including the body-input route (HttpInputOverHTTP.java:33). Filling rejects outstanding content references, and empty-buffer parsing cannot emit content because the content loop requires remaining bytes (HttpConnection.java:332, HttpParser.java:1653, HttpParser.java:1676). Consequently, parsing releases the empty buffer, nulls the connection field, and returns it to the pool (HttpConnection.java:382, HttpConnection.java:224). This complete fill-then-parse cleanup prevents the described leak despite the missing upstream in-fill release statement."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2024-8184"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-10051. The vulnerability describes HTTP request trailer cross-request leakage in Jetty 12.x where the _trailers field was not reset between requests. However, Jetty 9.4.41 already contains the fix from upstream commit be1eb26670 (July 2017, Simone Bordet), which properly resets _trailers to null in the recycle() method called after each request...",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-10051. The vulnerability describes HTTP request trailer cross-request leakage in Jetty 12.x where the _trailers field was not reset between requests. However, Jetty 9.4.41 already contains the fix from upstream commit be1eb26670 (July 2017, Simone Bordet), which properly resets _trailers to null in the recycle() method called after each request..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server. Version 9.4.41.v20210516 is not vulnerable. Summary: Target repository is Jetty 9.4.41.v20210516, which is outside the affected version range (12.0.0-12.0.31 and 12.1.0-12.0.5) and has a fundamentally different architecture that does not contain the vulnerable code patterns. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 9.4.41.v20210516 is not vulnerable. Summary: Target repository is Jetty 9.4.41.v20210516, which is outside the affected version range (12.0.0-12.0.31 and 12.1.0-12.0.5) and has a fundamentally different architecture that does not contain the vulnerable code patterns. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "action_statement": "Vulnerability CVE-2026-6790 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty:jetty-server."
    }
  ]
}