{ "@id": "urn:uuid:5e90052b-327a-4535-a0c8-991b786eca55", "role": "Document Creator", "author": "https://tuxcare.com", "version": 32, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T04:15:11.464324+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-03T15:07:22.154174+00:00", "status_notes": "Vulnerability CVE-2006-6969 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 describes predictable session ID generation due to unconditional use of java.util.Random in Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3. The target version 9.4.62.tuxcare0002 is NOT affected because the vulnerable pattern is not present. The code uses java.security.SecureRandom by default (DefaultSessionIdManager.java:374), only falling back to java.util.Random if S...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2006-6969" }, "impact_statement": "not_affected \u2014 CVE-2006-6969 describes predictable session ID generation due to unconditional use of java.util.Random in Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3. The target version 9.4.62.tuxcare0002 is NOT affected because the vulnerable pattern is not present. The code uses java.security.SecureRandom by default (DefaultSessionIdManager.java:374), only falling back to java.util.Random if S..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2011-4461 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 is not present in Jetty 9.4.62. The vulnerability involved unlimited form parameter processing that could trigger hash collision DoS attacks. The fix (adding maxFormKeys parameter limiting with default of 1000 keys) was implemented in upstream Jetty commit 085c79d7d6c from December 2011, long before version 9.4.62. This fix was already present in the upstream release 9.4.58.1 that...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-4461" }, "impact_statement": "not_affected \u2014 CVE-2011-4461 is not present in Jetty 9.4.62. The vulnerability involved unlimited form parameter processing that could trigger hash collision DoS attacks. The fix (adding maxFormKeys parameter limiting with default of 1000 keys) was implemented in upstream Jetty commit 085c79d7d6c from December 2011, long before version 9.4.62. This fix was already present in the upstream release 9.4.58.1 that..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-06T17:46:52.268713+00:00", "status_notes": "Vulnerability CVE-2015-2080 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 9.4.62 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-2080" }, "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 9.4.62 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-03T15:27:45.237635+00:00", "status_notes": "Vulnerability CVE-2016-4800 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.0-9.3.8 on Windows, where backslashes in URLs could bypass security constraints. The vulnerability was fixed in upstream Jetty 9.3.9 (May 2016) by commit 97af3d663fd. The target version 9.4.62 inherited this fix from the upstream release. The defense mechanism in PathResource.checkAliasPath() (lines 79-92) detects when Windows filesystem normalization alt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4800" }, "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.0-9.3.8 on Windows, where backslashes in URLs could bypass security constraints. The vulnerability was fixed in upstream Jetty 9.3.9 (May 2016) by commit 97af3d663fd. The target version 9.4.62 inherited this fix from the upstream release. The defense mechanism in PathResource.checkAliasPath() (lines 79-92) detects when Windows filesystem normalization alt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2017-7656 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2017-7656 HTTP Request Smuggling vulnerability is NOT present in target version 9.4.62. The upstream fix commit a285deea42fcab60d9edcf994e458c238a348b55 (authored by gregw@webtide.com in May 2018) was already included in upstream Jetty 9.4.62 when TuxCare onboarded it. The target implements all key defenses: (1) _hasContentLength flag to detect multiple Content-Length headers, (2) rejection of requests with both Content-Length and Transfer-Encoding headers, (3) chunk length overflow protection, and (4) HTTP version validation. These protections are enabled by default in RFC7230 compliance mode. The CVE explicitly states the vulnerability exists in \"9.4.x (non-default configuration with RFC2616 compliance enabled)\" - the default configuration is protected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7656" }, "impact_statement": "CVE-2017-7656 HTTP Request Smuggling vulnerability is NOT present in target version 9.4.62. The upstream fix commit a285deea42fcab60d9edcf994e458c238a348b55 (authored by gregw@webtide.com in May 2018) was already included in upstream Jetty 9.4.62 when TuxCare onboarded it. The target implements all key defenses: (1) _hasContentLength flag to detect multiple Content-Length headers, (2) rejection of requests with both Content-Length and Transfer-Encoding headers, (3) chunk length overflow protection, and (4) HTTP version validation. These protections are enabled by default in RFC7230 compliance mode. The CVE explicitly states the vulnerability exists in \"9.4.x (non-default configuration with RFC2616 compliance enabled)\" - the default configuration is protected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2017-7657 affects version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-7657" }, "action_statement": "Vulnerability CVE-2017-7657 affects version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2017-7658 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2017-7658 is NOT present in this target. The vulnerability concerns HTTP Request Smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked combinations. The upstream fix (commit a285deea42f, authored by Greg Wilkins on 2018-05-17) was already present in the upstream release 9.4.58.1 that TuxCare onboarded on 2025-12-12. The target at version 9.4.62 includes the complete defense: HttpParser.java tracks Content-Length headers via the _hasContentLength flag and rejects ambiguous requests with 400 Bad Request when compliance violations (MULTIPLE_CONTENT_LENGTHS or TRANSFER_ENCODING_WITH_CONTENT_LENGTH) are detected. The default compliance mode (RFC7230) includes both protections, making the defense active by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7658" }, "impact_statement": "CVE-2017-7658 is NOT present in this target. The vulnerability concerns HTTP Request Smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked combinations. The upstream fix (commit a285deea42f, authored by Greg Wilkins on 2018-05-17) was already present in the upstream release 9.4.58.1 that TuxCare onboarded on 2025-12-12. The target at version 9.4.62 includes the complete defense: HttpParser.java tracks Content-Length headers via the _hasContentLength flag and rejects ambiguous requests with 400 Bad Request when compliance violations (MULTIPLE_CONTENT_LENGTHS or TRANSFER_ENCODING_WITH_CONTENT_LENGTH) are detected. The default compliance mode (RFC7230) includes both protections, making the defense active by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2017-9735 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2017-9735 (timing channel attack in Password.java) is NOT present in Jetty 9.4.62. The vulnerability was fixed by upstream Jetty developers in commits 042f325f (May 2017), f3751d70 (May 2017), 2baa1abe (May 2017), and improved in 201a11a899c (Sep 2017) and e727ad893d2 (Oct 2018). These fixes were included in upstream releases jetty-9.2.23.v20171218 and jetty-9.4.13.v20181111, well before TuxCare onboarded version 9.4.58/9.4.62. The target code uses constant-time stringEquals() and byteEquals() methods throughout Password.java and Credential.java, eliminating timing side-channels. The fix is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-9735" }, "impact_statement": "CVE-2017-9735 (timing channel attack in Password.java) is NOT present in Jetty 9.4.62. The vulnerability was fixed by upstream Jetty developers in commits 042f325f (May 2017), f3751d70 (May 2017), 2baa1abe (May 2017), and improved in 201a11a899c (Sep 2017) and e727ad893d2 (Oct 2018). These fixes were included in upstream releases jetty-9.2.23.v20171218 and jetty-9.4.13.v20181111, well before TuxCare onboarded version 9.4.58/9.4.62. The target code uses constant-time stringEquals() and byteEquals() methods throughout Password.java and Credential.java, eliminating timing side-channels. The fix is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-10-31T18:07:40.353277+00:00", "status_notes": "Vulnerability CVE-2018-12536 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 is NOT present in Jetty 9.4.62. The vulnerability involved information disclosure where InvalidPathException messages containing full server filesystem paths were exposed in error responses when malformed URLs were processed. The upstream vendor fix (commit ad4dceb1c08, authored by Joakim Erdfelt) was already present in the upstream release before TuxCare onboarding. The fix wrap...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12536" }, "impact_statement": "not_affected \u2014 CVE-2018-12536 is NOT present in Jetty 9.4.62. The vulnerability involved information disclosure where InvalidPathException messages containing full server filesystem paths were exposed in error responses when malformed URLs were processed. The upstream vendor fix (commit ad4dceb1c08, authored by Joakim Erdfelt) was already present in the upstream release before TuxCare onboarding. The fix wrap..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2018-12538" }, "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-12545 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2018-12545 is NOT present in Jetty 9.4.62. The vulnerability (DoS via large or numerous HTTP/2 SETTINGS frames causing excessive CPU/memory allocation) was fixed by upstream Jetty in two commits: (1) 9eca404 (2018-07-18) added maxSettingsKeys limit (default 64) to reject large SETTINGS frames, and (2) cfe1baa (2019-08-17) added RateControl to limit SETTINGS frame rate (default 20/sec). Both fixes were already in the upstream Jetty 9.4.x release before TuxCare onboarded it. The target code at HEAD contains both defense mechanisms in SettingsBodyParser: lines 200-202 enforce the key limit, lines 228-229 enforce rate control. Verdict: not_affected (upstream vendor fix shipped in the release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12545" }, "impact_statement": "CVE-2018-12545 is NOT present in Jetty 9.4.62. The vulnerability (DoS via large or numerous HTTP/2 SETTINGS frames causing excessive CPU/memory allocation) was fixed by upstream Jetty in two commits: (1) 9eca404 (2018-07-18) added maxSettingsKeys limit (default 64) to reject large SETTINGS frames, and (2) cfe1baa (2019-08-17) added RateControl to limit SETTINGS frame rate (default 20/sec). Both fixes were already in the upstream Jetty 9.4.x release before TuxCare onboarded it. The target code at HEAD contains both defense mechanisms in SettingsBodyParser: lines 200-202 enforce the key limit, lines 228-229 enforce rate control. Verdict: not_affected (upstream vendor fix shipped in the release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-10-31T16:12:45.603403+00:00", "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty 9.4.62 is NOT AFFECTED by CVE-2019-10241. The XSS vulnerability in directory listings was fixed in upstream Jetty 9.4.16 (April 2019) via commits ca77bd384a29 and 7b774d82e823, both authored by upstream developer Joakim Erdfelt. The target version 9.4.62 inherits these fixes from the upstream release. The vulnerable pattern (unescaped filename rendering in directory listings) is no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10241" }, "impact_statement": "not_affected \u2014 Target Jetty 9.4.62 is NOT AFFECTED by CVE-2019-10241. The XSS vulnerability in directory listings was fixed in upstream Jetty 9.4.16 (April 2019) via commits ca77bd384a29 and 7b774d82e823, both authored by upstream developer Joakim Erdfelt. The target version 9.4.62 inherits these fixes from the upstream release. The vulnerable pattern (unescaped filename rendering in directory listings) is no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2019-10246 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 affects Jetty versions 9.2.27, 9.3.26, and 9.4.16 on Windows, exposing fully qualified directory paths in directory listings. The target version 9.4.62.tuxcare0002 contains the upstream fix (commit 3d028ab2ca7 by Joakim Erdfelt) that replaced the vulnerable getName() path-stripping logic with a proper getFileName() method. This fix was already present in the upstream Jetty 9.4.58...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10246" }, "impact_statement": "not_affected \u2014 CVE-2019-10246 affects Jetty versions 9.2.27, 9.3.26, and 9.4.16 on Windows, exposing fully qualified directory paths in directory listings. The target version 9.4.62.tuxcare0002 contains the upstream fix (commit 3d028ab2ca7 by Joakim Erdfelt) that replaced the vulnerable getName() path-stripping logic with a proper getFileName() method. This fix was already present in the upstream Jetty 9.4.58..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-10-31T16:32:00.096341+00:00", "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247: The target version 9.4.62 is not affected. The vulnerable pattern (DefaultHandler calling context.toString() which reveals base resource filesystem paths in 404 error output) was removed by upstream commit d983890d176 in April 2019. This fix was already present in the upstream release that TuxCare onboarded, predating all TuxCare modifications to this codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10247" }, "impact_statement": "not_affected \u2014 CVE-2019-10247: The target version 9.4.62 is not affected. The vulnerable pattern (DefaultHandler calling context.toString() which reveals base resource filesystem paths in 404 error output) was removed by upstream commit d983890d176 in April 2019. This fix was already present in the upstream release that TuxCare onboarded, predating all TuxCare modifications to this codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-02T19:15:55.561862+00:00", "status_notes": "Vulnerability CVE-2019-17632 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 affects Eclipse Jetty versions 9.4.21-9.4.23 where exception messages in error responses were not escaped, enabling XSS attacks. The target version 9.4.62.tuxcare0002 includes the upstream fix commits (9e40fc9a6fb, cf0df6e3ffd) from November 2019 that add sanitization via StringUtil.sanitizeXmlString() for both JSON error messages and HTML stack traces. These fixes were already p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17632" }, "impact_statement": "not_affected \u2014 CVE-2019-17632 affects Eclipse Jetty versions 9.4.21-9.4.23 where exception messages in error responses were not escaped, enabling XSS attacks. The target version 9.4.62.tuxcare0002 includes the upstream fix commits (9e40fc9a6fb, cf0df6e3ffd) from November 2019 that add sanitization via StringUtil.sanitizeXmlString() for both JSON error messages and HTML stack traces. These fixes were already p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2019-17638 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. The target repository (Eclipse Jetty 9.4.62) is not affected by CVE-2019-17638. The vulnerability, which caused a double-release of ByteBuffer leading to cross-client information disclosure, was fixed in upstream Jetty version 9.4.30 (commit ff8ae56fa939 by Greg Wilkins on 2020-06-03). The TuxCare branch was onboarded from version 9.4.58.1, which already contained this upstream fix. The vulnerable code pattern (class-level volatile _chunk field and premature buffer release in HEADER_OVERFLOW case) is absent from the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17638" }, "impact_statement": "The target repository (Eclipse Jetty 9.4.62) is not affected by CVE-2019-17638. The vulnerability, which caused a double-release of ByteBuffer leading to cross-client information disclosure, was fixed in upstream Jetty version 9.4.30 (commit ff8ae56fa939 by Greg Wilkins on 2020-06-03). The TuxCare branch was onboarded from version 9.4.58.1, which already contained this upstream fix. The vulnerable code pattern (class-level volatile _chunk field and premature buffer release in HEADER_OVERFLOW case) is absent from the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-02T19:35:10.370659+00:00", "status_notes": "Vulnerability CVE-2020-27218 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 describes a vulnerability where unconsumed GZIP-compressed request body content can be prepended to subsequent requests on the same persistent HTTP connection, allowing data injection. The target repository (Jetty 9.4.62.tuxcare0002) contains the complete upstream fix from commit 14f94f738df5 (Issue #5605), which was included in upstream release jetty-9.4.35.v20201120 (November 2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27218" }, "impact_statement": "not_affected \u2014 CVE-2020-27218 describes a vulnerability where unconsumed GZIP-compressed request body content can be prepended to subsequent requests on the same persistent HTTP connection, allowing data injection. The target repository (Jetty 9.4.62.tuxcare0002) contains the complete upstream fix from commit 14f94f738df5 (Issue #5605), which was included in upstream release jetty-9.4.35.v20201120 (November 2..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-02T19:28:26.306481+00:00", "status_notes": "Vulnerability CVE-2020-27223 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 9.4.62 repository is NOT AFFECTED by CVE-2020-27223. The vulnerable O(n\u00b2) bubble-sort algorithm in QuotedQualityCSV has been replaced with an efficient O(n log n) comparator-based sort. The fix (commit 10e531756b972162eed402c44d0244f7f6b85131) was already present in the upstream Jetty 9.4.58.1 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare bac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27223" }, "impact_statement": "not_affected \u2014 The target Jetty 9.4.62 repository is NOT AFFECTED by CVE-2020-27223. The vulnerable O(n\u00b2) bubble-sort algorithm in QuotedQualityCSV has been replaced with an efficient O(n log n) comparator-based sort. The fix (commit 10e531756b972162eed402c44d0244f7f6b85131) was already present in the upstream Jetty 9.4.58.1 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare bac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-03T11:38:59.216006+00:00", "status_notes": "Vulnerability CVE-2021-28165 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2021-28165 is NOT present in Jetty 9.4.62. The vulnerability involved an infinite loop when handling large TLS frames (>17408 bytes) that caused 100% CPU usage. The upstream Eclipse Jetty project fixed this in commit 294b2ba02b6 (March 22, 2021), first released in jetty-9.4.39.v20210325. The fix adds a buffer space check (BufferUtil.space(_encryptedInput) == 0) in the BUFFER_UNDERFLOW case to throw SSLHandshakeException and prevent the infinite retry loop. This fix was already present in the upstream 9.4.58.1 release that TuxCare onboarded, confirmed by verifying the fix commit is an ancestor of the first TuxCare commit (d8aedf0e4210 \"setup 9.4.58.1\"). The target version 9.4.62 inherited this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-28165" }, "impact_statement": "CVE-2021-28165 is NOT present in Jetty 9.4.62. The vulnerability involved an infinite loop when handling large TLS frames (>17408 bytes) that caused 100% CPU usage. The upstream Eclipse Jetty project fixed this in commit 294b2ba02b6 (March 22, 2021), first released in jetty-9.4.39.v20210325. The fix adds a buffer space check (BufferUtil.space(_encryptedInput) == 0) in the BUFFER_UNDERFLOW case to throw SSLHandshakeException and prevent the infinite retry loop. This fix was already present in the upstream 9.4.58.1 release that TuxCare onboarded, confirmed by verifying the fix commit is an ancestor of the first TuxCare commit (d8aedf0e4210 \"setup 9.4.58.1\"). The target version 9.4.62 inherited this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-34428 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. Version 9.4.62 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.", "vulnerability": { "name": "CVE-2021-34428" }, "impact_statement": "Version 9.4.62 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-09T20:56:00.075843+00:00", "status_notes": "Vulnerability CVE-2022-2191 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. TLS processing reaches `SslConnection` through the server factory (SslConnectionFactory.java:139). The patch\u2019s unconditional disposal is absent from the fill/flush catches and close method (SslConnection.java:816, SslConnection.java:1185, SslConnection.java:1408). The existing release helpers require empty buffers, so the current run\u2019s reliance on finally blocks does not establish complete cleanup (SslConnection.java:453). However, the connector defaults to `ArrayByteBufferPool`, whose acquisition returns a dequeued buffer or allocates an ordinary buffer (AbstractConnector.java:193, ArrayByteBufferPool.java:123). Its bucket removes acquired buffers with `poll()` and stores them again only upon release, without retaining active entries (ByteBufferPool.java:181, ByteBufferPool.java:208).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2022-2191" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. TLS processing reaches `SslConnection` through the server factory (SslConnectionFactory.java:139). The patch\u2019s unconditional disposal is absent from the fill/flush catches and close method (SslConnection.java:816, SslConnection.java:1185, SslConnection.java:1408). The existing release helpers require empty buffers, so the current run\u2019s reliance on finally blocks does not establish complete cleanup (SslConnection.java:453). However, the connector defaults to `ArrayByteBufferPool`, whose acquisition returns a dequeued buffer or allocates an ordinary buffer (AbstractConnector.java:193, ArrayByteBufferPool.java:123). Its bucket removes acquired buffers with `poll()` and stores them again only upon release, without retaining active entries (ByteBufferPool.java:181, ByteBufferPool.java:208)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-10-31T15:30:05.845366+00:00", "status_notes": "Vulnerability CVE-2023-26048 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 9.4.62 is not affected by CVE-2023-26048. The upstream fix from commit c3021592218 (Jetty 9.4.51.v20230217) is already present in the target codebase. Both defense mechanisms are implemented and active: (1) max parts limit (DEFAULT_MAX_FORM_KEYS=1000) enforced in MultiPartFormInputStream and MultiPartInputStreamParser, and (2) cumulative non-file part size limit (DEFAULT_MAX_FO...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26048" }, "impact_statement": "not_affected \u2014 The target Jetty 9.4.62 is not affected by CVE-2023-26048. The upstream fix from commit c3021592218 (Jetty 9.4.51.v20230217) is already present in the target codebase. Both defense mechanisms are implemented and active: (1) max parts limit (DEFAULT_MAX_FORM_KEYS=1000) enforced in MultiPartFormInputStream and MultiPartInputStreamParser, and (2) cumulative non-file part size limit (DEFAULT_MAX_FO..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-10-31T14:57:00.087102+00:00", "status_notes": "Vulnerability CVE-2023-26049 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 is not present in this version. The vulnerability involved nonstandard cookie parsing where semicolons inside quoted cookie values were treated as part of the value, enabling cookie smuggling. The fix (upstream commit 1be1401bafb by Greg Wilkins) was already present in the upstream Jetty 9.4.x release that TuxCare onboarded. The fix adds strict RFC6265 compliance mode that reject...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26049" }, "impact_statement": "not_affected \u2014 CVE-2023-26049 is not present in this version. The vulnerability involved nonstandard cookie parsing where semicolons inside quoted cookie values were treated as part of the value, enabling cookie smuggling. The fix (upstream commit 1be1401bafb by Greg Wilkins) was already present in the upstream Jetty 9.4.x release that TuxCare onboarded. The fix adds strict RFC6265 compliance mode that reject..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2024-13009 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2024-13009 affects Eclipse Jetty versions 9.4.0 to 9.4.56, addressing a buffer mismanagement vulnerability during gzip decompression errors. The target (version 9.4.62.tuxcare0002) already contains the upstream fix commit e3fa9466633 authored by gregw@webtide.com. This fix was shipped in upstream release 9.4.57 (December 2024), which predates TuxCare's onboarding of version 9.4.58.1. All fix components verified present: buffer nulling on content failure (HttpInput.java:187-188, 597-598), error state check (line 382), direct interceptor call (line 466), and removal of the intercept() wrapper method. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-13009" }, "impact_statement": "CVE-2024-13009 affects Eclipse Jetty versions 9.4.0 to 9.4.56, addressing a buffer mismanagement vulnerability during gzip decompression errors. The target (version 9.4.62.tuxcare0002) already contains the upstream fix commit e3fa9466633 authored by gregw@webtide.com. This fix was shipped in upstream release 9.4.57 (December 2024), which predates TuxCare's onboarding of version 9.4.58.1. All fix components verified present: buffer nulling on content failure (HttpInput.java:187-188, 597-598), error state check (line 382), direct interceptor call (line 466), and removal of the intercept() wrapper method. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-11-10T04:15:11.464324+00:00", "status_notes": "Vulnerability CVE-2024-7708 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because existing cleanup prevents request buffers from leaking after zero-byte reads. The content loop parses the buffer before checking for a zero-byte result (jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:327). Parsing triggers buffer release (jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:387), which clears the connection\u2019s buffer reference and returns the empty buffer to the pool (jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:226).", "vulnerability": { "name": "CVE-2024-7708" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because existing cleanup prevents request buffers from leaking after zero-byte reads. The content loop parses the buffer before checking for a zero-byte result (jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:327). Parsing triggers buffer release (jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:387), which clears the connection\u2019s buffer reference and returns the empty buffer to the pool (jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:226)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8184 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-8184" }, "impact_statement": "Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10051 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 Version 9.4.x uses a different architecture than the affected 11.x/12.x versions. The vulnerability requires a connection-scoped HttpConnection._trailers field that is never cleared between requests. Version 9.4.x instead uses HttpChannel-scoped _trailers that IS properly cleared in HttpChannel.recycle(), preventing cross-request trailer leakage.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-10051" }, "impact_statement": "not_affected \u2014 Version 9.4.x uses a different architecture than the affected 11.x/12.x versions. The vulnerability requires a connection-scoped HttpConnection._trailers field that is never cleared between requests. Version 9.4.x instead uses HttpChannel-scoped _trailers that IS properly cleared in HttpChannel.recycle(), preventing cross-request trailer leakage." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1605" }, "impact_statement": "Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.62.tuxcare0002" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 9.4.62.tuxcare0002 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-6790" } } ] }