{ "@id": "urn:uuid:4711b6e4-c247-42e2-80ae-5bbb9b78463b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 33, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:15:11.464324+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-03T15:05:45.890515+00:00", "status_notes": "Vulnerability CVE-2006-6969 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 describes Jetty versions before 6.1.0pre3 generating predictable session identifiers using java.util.Random. The target version (9.4.59.tuxcare0003) uses SecureRandom by default for session ID generation, introduced by upstream commit c3275730b913 in April 2010. This fix was already present in the upstream release that TuxCare onboarded (first TuxCare commit 9d156f84aa93 from Dece...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2006-6969" }, "impact_statement": "not_affected \u2014 CVE-2006-6969 describes Jetty versions before 6.1.0pre3 generating predictable session identifiers using java.util.Random. The target version (9.4.59.tuxcare0003) uses SecureRandom by default for session ID generation, introduced by upstream commit c3275730b913 in April 2010. This fix was already present in the upstream release that TuxCare onboarded (first TuxCare commit 9d156f84aa93 from Dece..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2011-4461 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target (Jetty 9.4.59.tuxcare0003) is not affected by CVE-2011-4461. The vulnerability pattern (unlimited form parameter processing enabling hash collision DoS attacks) is not present because the upstream fix was already included in the Jetty 9.4.x release series that TuxCare onboarded. The maxFormKeys defense (default limit of 1000 parameters) is fully implemented in Request.java, ContextHa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-4461" }, "impact_statement": "not_affected \u2014 The target (Jetty 9.4.59.tuxcare0003) is not affected by CVE-2011-4461. The vulnerability pattern (unlimited form parameter processing enabling hash collision DoS attacks) is not present because the upstream fix was already included in the Jetty 9.4.x release series that TuxCare onboarded. The maxFormKeys defense (default limit of 1000 parameters) is fully implemented in Request.java, ContextHa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-06T17:46:02.067236+00:00", "status_notes": "Vulnerability CVE-2015-2080 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 9.4.59 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-2080" }, "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 9.4.59 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-03T15:26:10.977883+00:00", "status_notes": "Vulnerability CVE-2016-4800 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 due to path normalization bypass on Windows. The target version 9.4.59.tuxcare0003 is NOT vulnerable. The fix (commit 97af3d663fd) was authored by upstream developer Joakim Erdfelt on May 13, 2016, and shipped in upstream Jetty 9.3.10+. This fix was already present in the upstream release (9.4.58.1) that TuxCare onboarded, as confirmed by t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4800" }, "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 due to path normalization bypass on Windows. The target version 9.4.59.tuxcare0003 is NOT vulnerable. The fix (commit 97af3d663fd) was authored by upstream developer Joakim Erdfelt on May 13, 2016, and shipped in upstream Jetty 9.3.10+. This fix was already present in the upstream release (9.4.58.1) that TuxCare onboarded, as confirmed by t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2017-7656 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2017-7656 HTTP Request Smuggling vulnerability is NOT present in target Jetty 9.4.59.tuxcare0003. The upstream fix (commit a285deea42f by Greg Wilkins, May 2018) shipped with Jetty 9.4.59 and was already present when TuxCare onboarded this version. All three defenses are verified in HttpParser.java: (1) multiple Content-Length header rejection, (2) Content-Length + Transfer-Encoding conflict rejection, and (3) chunk length overflow protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7656" }, "impact_statement": "CVE-2017-7656 HTTP Request Smuggling vulnerability is NOT present in target Jetty 9.4.59.tuxcare0003. The upstream fix (commit a285deea42f by Greg Wilkins, May 2018) shipped with Jetty 9.4.59 and was already present when TuxCare onboarded this version. All three defenses are verified in HttpParser.java: (1) multiple Content-Length header rejection, (2) Content-Length + Transfer-Encoding conflict rejection, and (3) chunk length overflow protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2017-7657 affects version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-7657" }, "action_statement": "Vulnerability CVE-2017-7657 affects version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2017-7658 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. Target version 9.4.59 is not affected by CVE-2017-7658. The upstream fix (commit a285deea42f \"Issue #2529 RFC2616 vs RFC7230 cleanup\" by Greg Wilkins) was already present in the upstream 9.4.59 release that TuxCare onboarded. The target implements the required defenses via HttpComplianceSection validation: rejecting multiple Content-Length headers (lines 977-984) and rejecting mixed Content-Length/Transfer-Encoding headers (lines 974-975, 996-997). The vulnerable code pattern\u2014accepting ambiguous request framing that enables HTTP Request Smuggling\u2014is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7658" }, "impact_statement": "Target version 9.4.59 is not affected by CVE-2017-7658. The upstream fix (commit a285deea42f \"Issue #2529 RFC2616 vs RFC7230 cleanup\" by Greg Wilkins) was already present in the upstream 9.4.59 release that TuxCare onboarded. The target implements the required defenses via HttpComplianceSection validation: rejecting multiple Content-Length headers (lines 977-984) and rejecting mixed Content-Length/Transfer-Encoding headers (lines 974-975, 996-997). The vulnerable code pattern\u2014accepting ambiguous request framing that enables HTTP Request Smuggling\u2014is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2017-9735 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. The timing channel vulnerability CVE-2017-9735 in Password.java has been fixed by upstream Jetty and the fix was included in the Jetty 9.4.x release that TuxCare onboarded. The target version 9.4.59.tuxcare0003 contains the complete fix implementing constant-time string and byte comparison methods (stringEquals, byteEquals) across all password/credential verification code paths. The vulnerable pattern (variable-time String.equals() and Arrays.equals() in authentication) is not present in the current code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-9735" }, "impact_statement": "The timing channel vulnerability CVE-2017-9735 in Password.java has been fixed by upstream Jetty and the fix was included in the Jetty 9.4.x release that TuxCare onboarded. The target version 9.4.59.tuxcare0003 contains the complete fix implementing constant-time string and byte comparison methods (stringEquals, byteEquals) across all password/credential verification code paths. The vulnerable pattern (variable-time String.equals() and Arrays.equals() in authentication) is not present in the current code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-10-31T18:00:35.631944+00:00", "status_notes": "Vulnerability CVE-2018-12536 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 affects Eclipse Jetty 9.x when bad characters in request paths trigger InvalidPathException, revealing full filesystem paths in error responses. The target (Jetty 9.4.59.tuxcare0003) contains upstream fix commit 53e8bc2a636 that wraps all exceptions in ResourceContentFactory.getContent() with sanitized InvalidPathException containing only user input, not full paths. This fix was ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12536" }, "impact_statement": "not_affected \u2014 CVE-2018-12536 affects Eclipse Jetty 9.x when bad characters in request paths trigger InvalidPathException, revealing full filesystem paths in error responses. The target (Jetty 9.4.59.tuxcare0003) contains upstream fix commit 53e8bc2a636 that wraps all exceptions in ResourceContentFactory.getContent() with sanitized InvalidPathException containing only user input, not full paths. This fix was ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2018-12538" }, "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-12545 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2018-12545 is NOT present in Jetty 9.4.59.tuxcare0003. The target already contains both upstream fixes: (1) maxKeys limit that restricts settings keys per frame to 64 (SettingsFrame.DEFAULT_MAX_KEYS), enforced in SettingsBodyParser.onSetting() at lines 198-205, and (2) RateControl infrastructure that limits frame rate, enforced at line 228. These fixes were introduced by upstream Jetty developer Simone Bordet in commits 9eca404da29 (July 2018, issue #2722) and cfe1baa0482 (August 2019, issue #3978), both predating the first TuxCare commit by years. The fixes shipped in upstream Jetty 9.4.12+ and 9.4.21+ respectively, well before the 9.4.59 release TuxCare onboarded in December 2025.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12545" }, "impact_statement": "CVE-2018-12545 is NOT present in Jetty 9.4.59.tuxcare0003. The target already contains both upstream fixes: (1) maxKeys limit that restricts settings keys per frame to 64 (SettingsFrame.DEFAULT_MAX_KEYS), enforced in SettingsBodyParser.onSetting() at lines 198-205, and (2) RateControl infrastructure that limits frame rate, enforced at line 228. These fixes were introduced by upstream Jetty developer Simone Bordet in commits 9eca404da29 (July 2018, issue #2722) and cfe1baa0482 (August 2019, issue #3978), both predating the first TuxCare commit by years. The fixes shipped in upstream Jetty 9.4.12+ and 9.4.21+ respectively, well before the 9.4.59 release TuxCare onboarded in December 2025.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-10-31T16:00:11.895741+00:00", "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 XSS vulnerability in directory listing is NOT present in target Jetty 9.4.59. The upstream vendor fix (commit 7b774d82e82 by joakim.erdfelt@gmail.com, dated 2019-04-16) was already included in the upstream Jetty release when TuxCare onboarded version 9.4.58.1. The fix adds a getFileName() method that properly extracts filename-only segments, URL-decodes them, and HTML-encodes out...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10241" }, "impact_statement": "not_affected \u2014 CVE-2019-10241 XSS vulnerability in directory listing is NOT present in target Jetty 9.4.59. The upstream vendor fix (commit 7b774d82e82 by joakim.erdfelt@gmail.com, dated 2019-04-16) was already included in the upstream Jetty release when TuxCare onboarded version 9.4.58.1. The fix adds a getFileName() method that properly extracts filename-only segments, URL-decodes them, and HTML-encodes out..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2019-10246 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 9.4.59.tuxcare0003) is NOT AFFECTED by CVE-2019-10246. The vulnerability was fixed in upstream Jetty 9.4.17 (April 2019) by commit 7b774d82e82, authored by Joakim Erdfelt. This fix was already present in the upstream release when TuxCare onboarded version 9.4.58.1. The vulnerable code pattern (using `item.getName()` which exposes full filesystem paths on Windows in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10246" }, "impact_statement": "not_affected \u2014 The target repository (Jetty 9.4.59.tuxcare0003) is NOT AFFECTED by CVE-2019-10246. The vulnerability was fixed in upstream Jetty 9.4.17 (April 2019) by commit 7b774d82e82, authored by Joakim Erdfelt. This fix was already present in the upstream release when TuxCare onboarded version 9.4.58.1. The vulnerable code pattern (using `item.getName()` which exposes full filesystem paths on Windows in ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-10-31T16:23:38.824068+00:00", "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 affects Jetty versions that expose filesystem paths (base resource locations) in 404 error responses via context.toString() output. The target version 9.4.59 does not contain this vulnerability. The vulnerable pattern was removed by upstream commit 04c994712c0 (April 2019) which shipped in Jetty 9.4.17, well before TuxCare began maintaining the 9.4.59 lineage. The current Default...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10247" }, "impact_statement": "not_affected \u2014 CVE-2019-10247 affects Jetty versions that expose filesystem paths (base resource locations) in 404 error responses via context.toString() output. The target version 9.4.59 does not contain this vulnerability. The vulnerable pattern was removed by upstream commit 04c994712c0 (April 2019) which shipped in Jetty 9.4.17, well before TuxCare began maintaining the 9.4.59 lineage. The current Default..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-02T19:14:00.100615+00:00", "status_notes": "Vulnerability CVE-2019-17632 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 affects Eclipse Jetty 9.4.21-9.4.23 where exception messages in error responses (text/html and text/json) are not escaped, enabling XSS. The target version 9.4.59.tuxcare0003 contains the upstream fix (commits 9e40fc9a6fb and cf0df6e3ffd from Nov 2019) that routes all exception text through StringUtil.sanitizeXmlString() which escapes <, >, &, ', and \". The fix was authored by up...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17632" }, "impact_statement": "not_affected \u2014 CVE-2019-17632 affects Eclipse Jetty 9.4.21-9.4.23 where exception messages in error responses (text/html and text/json) are not escaped, enabling XSS. The target version 9.4.59.tuxcare0003 contains the upstream fix (commits 9e40fc9a6fb and cf0df6e3ffd from Nov 2019) that routes all exception text through StringUtil.sanitizeXmlString() which escapes <, >, &, ', and \". The fix was authored by up..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2019-17638 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. The target repository (Jetty 9.4.59.tuxcare0003) is NOT affected by CVE-2019-17638. The vulnerability (double-release of ByteBuffer leading to cross-client data leakage) was fixed in upstream commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba (June 2020) by Greg Wilkins. This fix was already present in the upstream release 9.4.58.1 that TuxCare onboarded, well before the current version. The fix introduces helper methods (releaseHeader(), releaseChunk()) that atomically release AND null buffer references, preventing double-release even when exceptions occur during HEADER_OVERFLOW handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17638" }, "impact_statement": "The target repository (Jetty 9.4.59.tuxcare0003) is NOT affected by CVE-2019-17638. The vulnerability (double-release of ByteBuffer leading to cross-client data leakage) was fixed in upstream commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba (June 2020) by Greg Wilkins. This fix was already present in the upstream release 9.4.58.1 that TuxCare onboarded, well before the current version. The fix introduces helper methods (releaseHeader(), releaseChunk()) that atomically release AND null buffer references, preventing double-release even when exceptions occur during HEADER_OVERFLOW handling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-02T19:32:48.041601+00:00", "status_notes": "Vulnerability CVE-2020-27218 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 describes a vulnerability where unconsumed GZIP-compressed request body data on HTTP/1.x persistent connections can leak into subsequent requests, enabling data injection. The upstream vendor (Eclipse Jetty) fixed this in commit 14f94f738df (Issue #5605) released in version 9.4.35.v20201120 (November 2020). The fix introduces ensureConsumeAllOrNotPersistent() which ensures uncons...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27218" }, "impact_statement": "not_affected \u2014 CVE-2020-27218 describes a vulnerability where unconsumed GZIP-compressed request body data on HTTP/1.x persistent connections can leak into subsequent requests, enabling data injection. The upstream vendor (Eclipse Jetty) fixed this in commit 14f94f738df (Issue #5605) released in version 9.4.35.v20201120 (November 2020). The fix introduces ensureConsumeAllOrNotPersistent() which ensures uncons..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-02T19:25:54.752910+00:00", "status_notes": "Vulnerability CVE-2020-27223 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 9.4.59 is not affected by CVE-2020-27223. The vulnerability involved an inefficient bubble-sort-like algorithm in QuotedQualityCSV.sort() that caused O(n\u00b2) or worse time complexity when processing HTTP headers with many quality parameters. The vulnerable pattern (loop reset via 'i = _values.size()') is absent from the target code. The fix (commit 10e531756b9) replacing the inef...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27223" }, "impact_statement": "not_affected \u2014 The target Jetty 9.4.59 is not affected by CVE-2020-27223. The vulnerability involved an inefficient bubble-sort-like algorithm in QuotedQualityCSV.sort() that caused O(n\u00b2) or worse time complexity when processing HTTP headers with many quality parameters. The vulnerable pattern (loop reset via 'i = _values.size()') is absent from the target code. The fix (commit 10e531756b9) replacing the inef..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2021-28165 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2021-28165 (Jetty SSL/TLS CPU exhaustion from large TLS frames) is NOT present in the target. The fix was introduced in upstream Jetty 9.4.39.v20210325 by commit 00d379c94ba (author: Joakim Erdfelt), which added a buffer space check to prevent infinite unwrap loops. The target is at version 9.4.59.tuxcare0003, which already includes this upstream fix. The defense code at SslConnection.java:753-757 checks if the encrypted input buffer has no remaining space and throws SSLHandshakeException to halt processing, preventing the CPU exhaustion attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-28165" }, "impact_statement": "CVE-2021-28165 (Jetty SSL/TLS CPU exhaustion from large TLS frames) is NOT present in the target. The fix was introduced in upstream Jetty 9.4.39.v20210325 by commit 00d379c94ba (author: Joakim Erdfelt), which added a buffer space check to prevent infinite unwrap loops. The target is at version 9.4.59.tuxcare0003, which already includes this upstream fix. The defense code at SslConnection.java:753-757 checks if the encrypted input buffer has no remaining space and throws SSLHandshakeException to halt processing, preventing the CPU exhaustion attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-34428 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. Version 9.4.59 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.", "vulnerability": { "name": "CVE-2021-34428" }, "impact_statement": "Version 9.4.59 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-10T04:15:11.464324+00:00", "status_notes": "Vulnerability CVE-2022-2191 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its buffer pool does not retain acquired buffers as active entries, so unreleased buffers can be garbage collected. Acquisition removes buffers from the pool or allocates new ones (jetty-io/src/main/java/org/eclipse/jetty/io/ArrayByteBufferPool.java:123), and the pool interface explicitly permits garbage collection of unreleased buffers (jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:35).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2022-2191" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its buffer pool does not retain acquired buffers as active entries, so unreleased buffers can be garbage collected. Acquisition removes buffers from the pool or allocates new ones (jetty-io/src/main/java/org/eclipse/jetty/io/ArrayByteBufferPool.java:123), and the pool interface explicitly permits garbage collection of unreleased buffers (jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:35)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-10-31T15:26:37.896727+00:00", "status_notes": "Vulnerability CVE-2023-26048 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 9.4.59.tuxcare0003 is NOT AFFECTED by CVE-2023-26048. The vulnerable code pattern (unbounded memory consumption during multipart parsing) is not present because the upstream fix was already included in the release. Both required defenses are present: (1) max parts limit via _maxParts counter (lines 770-772 in MultiPartFormInputStream.java), and (2) accumulated size check for part...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26048" }, "impact_statement": "not_affected \u2014 Target version 9.4.59.tuxcare0003 is NOT AFFECTED by CVE-2023-26048. The vulnerable code pattern (unbounded memory consumption during multipart parsing) is not present because the upstream fix was already included in the release. Both required defenses are present: (1) max parts limit via _maxParts counter (lines 770-772 in MultiPartFormInputStream.java), and (2) accumulated size check for part..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-10-31T14:54:14.508350+00:00", "status_notes": "Vulnerability CVE-2023-26049 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values containing semicolons) is NOT present in target version 9.4.59. The upstream fix commit 1be1401bafb (authored by gregw@webtide.com) was already included in the upstream release before TuxCare onboarding. The fix modifies CookieCutter.java to reject cookies containing semicolons within quoted values when in RFC6265 compliance mode (the default)....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26049" }, "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values containing semicolons) is NOT present in target version 9.4.59. The upstream fix commit 1be1401bafb (authored by gregw@webtide.com) was already included in the upstream release before TuxCare onboarding. The fix modifies CookieCutter.java to reject cookies containing semicolons within quoted values when in RFC6265 compliance mode (the default)...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2024-13009 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. Target version 9.4.59.tuxcare0003 is not affected by CVE-2024-13009. The vulnerability concerns incorrect buffer release when gzip decompression errors occur during request body inflation, potentially causing buffer corruption or inadvertent data sharing between requests. The upstream fix (commit e3fa9466633 by Greg Wilkins ) was already present in the upstream release before TuxCare's onboarding. All four defensive changes from the patch are present in HttpInput.java at HEAD (e62cae0a65d): (1) fail() method nulls _content field after calling content.failed() (lines 187-188), (2) nextContent() adds && !isError() check to prevent content production in error state (line 382), (3) nextInterceptedContent() calls _interceptor.readFrom() directly without exception-catching wrapper (line 466), (4) addContent() nulls _content when content fails after EOF (lines 597-598). The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-13009" }, "impact_statement": "Target version 9.4.59.tuxcare0003 is not affected by CVE-2024-13009. The vulnerability concerns incorrect buffer release when gzip decompression errors occur during request body inflation, potentially causing buffer corruption or inadvertent data sharing between requests. The upstream fix (commit e3fa9466633 by Greg Wilkins ) was already present in the upstream release before TuxCare's onboarding. All four defensive changes from the patch are present in HttpInput.java at HEAD (e62cae0a65d): (1) fail() method nulls _content field after calling content.failed() (lines 187-188), (2) nextContent() adds && !isError() check to prevent content production in error state (line 382), (3) nextInterceptedContent() calls _interceptor.readFrom() directly without exception-catching wrapper (line 466), (4) addContent() nulls _content when content fails after EOF (lines 597-598). The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-10T04:14:20.974341+00:00", "status_notes": "Vulnerability CVE-2024-7708 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because request buffers are returned to the pool after zero-byte reads, preventing the buffer leak. Parsing calls releaseRequestBuffer() when no content references remain at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:387, and that method clears the buffer field and returns the empty buffer to the pool at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:224.", "vulnerability": { "name": "CVE-2024-7708" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because request buffers are returned to the pool after zero-byte reads, preventing the buffer leak. Parsing calls releaseRequestBuffer() when no content references remain at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:387, and that method clears the buffer field and returns the empty buffer to the pool at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:224." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8184 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. Version 9.4.59 is not vulnerable. Summary: The target repository already has the fix for CVE-2024-8184 applied. The vulnerable non-atomic check-then-act pattern in getRemote() has been replaced with atomic compute() operations, reference counting has been implemented, and cleanup logic has been added to prevent memory leaks. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-8184" }, "impact_statement": "Version 9.4.59 is not vulnerable. Summary: The target repository already has the fix for CVE-2024-8184 applied. The vulnerable non-atomic check-then-act pattern in getRemote() has been replaced with atomic compute() operations, reference counting has been implemented, and cleanup logic has been added to prevent memory leaks. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10051 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 9.4.59 does not contain the CVE-2026-10051 vulnerability. The target properly resets HTTP request trailers between requests via the HttpChannelOverHttp.recycle() method, preventing cross-request trailer leakage. This defensive pattern has been present since trailers support was first added to Jetty 9.4.x in 2017.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-10051" }, "impact_statement": "not_affected \u2014 Jetty 9.4.59 does not contain the CVE-2026-10051 vulnerability. The target properly resets HTTP request trailers between requests via the HttpChannelOverHttp.recycle() method, preventing cross-request trailer leakage. This defensive pattern has been present since trailers support was first added to Jetty 9.4.x in 2017." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1605 affects version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-1605" }, "action_statement": "Vulnerability CVE-2026-1605 affects version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.59.tuxcare0002" } } ], "timestamp": "2026-11-09T15:50:06.941986+00:00", "status_notes": "Vulnerability CVE-2026-6790 affects version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server, and is fixed in 9.4.59.tuxcare0004.", "vulnerability": { "name": "CVE-2026-6790" }, "action_statement": "Vulnerability CVE-2026-6790 affects version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-server, and is fixed in 9.4.59.tuxcare0004." } ] }