{ "@id": "urn:uuid:479f823c-2410-4760-a2b9-ee07355f2c7b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 17, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T16:29:48.390816+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-03T15:10:10.548488+00:00", "status_notes": "Vulnerability CVE-2006-6969 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 describes predictable session identifiers in Jetty versions before 6.1.0pre3 due to direct use of java.util.Random. The target (Jetty 9.4.66) uses java.security.SecureRandom by default (line 374 of DefaultSessionIdManager.java), with only an exceptional fallback to Random when SecureRandom initialization fails. This fallback includes additional entropy sources (freeMemory, hashCod...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2006-6969" }, "impact_statement": "not_affected \u2014 CVE-2006-6969 describes predictable session identifiers in Jetty versions before 6.1.0pre3 due to direct use of java.util.Random. The target (Jetty 9.4.66) uses java.security.SecureRandom by default (line 374 of DefaultSessionIdManager.java), with only an exceptional fallback to Random when SecureRandom initialization fails. This fallback includes additional entropy sources (freeMemory, hashCod..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2011-4461 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 9.4.66.tuxcare0001) is NOT vulnerable to CVE-2011-4461 (hash collision DOS). The fix (commit 085c79d7d6c) that limits form parameters to prevent unbounded processing was already present in upstream Jetty release 9.4.58.1, which TuxCare onboarded. The fix adds a maxFormKeys parameter (default 1000) that throws an exception when exceeded, preventing resource exhaustio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-4461" }, "impact_statement": "not_affected \u2014 The target repository (Jetty 9.4.66.tuxcare0001) is NOT vulnerable to CVE-2011-4461 (hash collision DOS). The fix (commit 085c79d7d6c) that limits form parameters to prevent unbounded processing was already present in upstream Jetty release 9.4.58.1, which TuxCare onboarded. The fix adds a maxFormKeys parameter (default 1000) that throws an exception when exceeded, preventing resource exhaustio..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2015-2080 affects version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2015-2080" }, "action_statement": "Vulnerability CVE-2015-2080 affects version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-03T15:33:21.899203+00:00", "status_notes": "Vulnerability CVE-2016-4800 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 due to insufficient path normalization on Windows that allowed encoded backslashes (%5C) to bypass security restrictions. The target version 9.4.66.tuxcare0001 is NOT AFFECTED because the fix was applied upstream in Jetty 9.3.9 (May 2016) and is present in version 9.4.66. The fix adds alias detection logic in PathResource.checkAliasPath() t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4800" }, "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 due to insufficient path normalization on Windows that allowed encoded backslashes (%5C) to bypass security restrictions. The target version 9.4.66.tuxcare0001 is NOT AFFECTED because the fix was applied upstream in Jetty 9.3.9 (May 2016) and is present in version 9.4.66. The fix adds alias detection logic in PathResource.checkAliasPath() t..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2017-7656 affects version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-7656" }, "action_statement": "Vulnerability CVE-2017-7656 affects version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2017-7657 affects version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-7657" }, "action_statement": "Vulnerability CVE-2017-7657 affects version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2017-7658 affects version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-7658" }, "action_statement": "Vulnerability CVE-2017-7658 affects version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-06T18:21:00.070168+00:00", "status_notes": "Vulnerability CVE-2017-9735 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 042f325f, 2baa1abe, f3751d70). The upstream fix was released in 9.4.6.v20170531, and version 9.4.66 is a later release of the same line. Advisories: GitHub GHSA-wfcc-pff6-rgc5 (fixed in 9.4.6.v20170531), NVD (fixed in 9.4.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-9735" }, "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 042f325f, 2baa1abe, f3751d70). The upstream fix was released in 9.4.6.v20170531, and version 9.4.66 is a later release of the same line. Advisories: GitHub GHSA-wfcc-pff6-rgc5 (fixed in 9.4.6.v20170531), NVD (fixed in 9.4.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-06T10:41:28.069303+00:00", "status_notes": "Vulnerability CVE-2018-12536 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The upstream fix for CVE-2018-12536 (jetty commits ad4dceb1c08 and 53e8bc2a636, issue #2560) is already in the target. ResourceContentFactory.getContent wraps every resource-lookup failure and rethrows it as a generic InvalidPathException with the message \"Invalid PathInContext\" and no base directory. The fix shipped in the upstream release that TuxCare onboarded, so this is an upstream fix rat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12536" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2018-12536 (jetty commits ad4dceb1c08 and 53e8bc2a636, issue #2560) is already in the target. ResourceContentFactory.getContent wraps every resource-lookup failure and rethrows it as a generic InvalidPathException with the message \"Invalid PathInContext\" and no base directory. The fix shipped in the upstream release that TuxCare onboarded, so this is an upstream fix rat..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2018-12538" }, "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2018-12545 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. The target Jetty 9.4.66.tuxcare0001 is NOT AFFECTED by CVE-2018-12545. Both defenses required to mitigate the vulnerability are present and enabled by default: (1) maxSettingsKeys limiting cumulative settings keys to 64, and (2) WindowRateControl limiting frame processing to 128 events/second. These fixes were authored by upstream Jetty developers (Simone Bordet, Greg Wilkins) and were already present in the upstream Jetty 9.4.58.1 release that TuxCare onboarded, predating the first TuxCare commit (97bdda8388070634d48634ba077930a86243abdd). The vulnerable pattern (unbounded SETTINGS frame processing leading to DoS) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12545" }, "impact_statement": "The target Jetty 9.4.66.tuxcare0001 is NOT AFFECTED by CVE-2018-12545. Both defenses required to mitigate the vulnerability are present and enabled by default: (1) maxSettingsKeys limiting cumulative settings keys to 64, and (2) WindowRateControl limiting frame processing to 128 events/second. These fixes were authored by upstream Jetty developers (Simone Bordet, Greg Wilkins) and were already present in the upstream Jetty 9.4.58.1 release that TuxCare onboarded, predating the first TuxCare commit (97bdda8388070634d48634ba077930a86243abdd). The vulnerable pattern (unbounded SETTINGS frame processing leading to DoS) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-06T07:20:00.085500+00:00", "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 9.4.66.tuxcare0001 is not affected by CVE-2019-10241. The directory-listing XSS fix (upstream commit ca77bd384a, \"Issue #3319 - Refactoring DefaultServlet Index/Listing\", also reachable via merge 1565b5f) is already in the upstream base release. Resource.getListHTML escapes the directory title and entry names with deTag and encodes the base href with hrefEncodeURI. Both fix commits are by...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10241" }, "impact_statement": "not_affected \u2014 Jetty 9.4.66.tuxcare0001 is not affected by CVE-2019-10241. The directory-listing XSS fix (upstream commit ca77bd384a, \"Issue #3319 - Refactoring DefaultServlet Index/Listing\", also reachable via merge 1565b5f) is already in the upstream base release. Resource.getListHTML escapes the directory title and entry names with deTag and encodes the base href with hrefEncodeURI. Both fix commits are by..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-02T15:11:52.923350+00:00", "status_notes": "Vulnerability CVE-2019-10246 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 9.4.66.tuxcare0001 is NOT AFFECTED by CVE-2019-10246. The vulnerability involved directory listings exposing fully qualified filesystem paths on Windows. The fix (adding getFileName() method to extract only filenames) was already present in upstream Jetty 9.4.58.1 when TuxCare onboarded this project. The vulnerable code pattern that used getName() and extracted paths via string...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10246" }, "impact_statement": "not_affected \u2014 The target Jetty 9.4.66.tuxcare0001 is NOT AFFECTED by CVE-2019-10246. The vulnerability involved directory listings exposing fully qualified filesystem paths on Windows. The fix (adding getFileName() method to extract only filenames) was already present in upstream Jetty 9.4.58.1 when TuxCare onboarded this project. The vulnerable code pattern that used getName() and extracted paths via string..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-06T07:20:00.085500+00:00", "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 9.4.66 is not affected by CVE-2019-10247. DefaultHandler's 404 context listing prints only context path, display name, availability and lifecycle state. It no longer prints the base resource directory. The upstream fix (04c994712c0b, \"Do not reveal base resource in error response\", by joakim.erdfelt@gmail.com) is already part of the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10247" }, "impact_statement": "not_affected \u2014 Jetty 9.4.66 is not affected by CVE-2019-10247. DefaultHandler's 404 context listing prints only context path, display name, availability and lifecycle state. It no longer prints the base resource directory. The upstream fix (04c994712c0b, \"Do not reveal base resource in error response\", by joakim.erdfelt@gmail.com) is already part of the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-02T19:19:00.599819+00:00", "status_notes": "Vulnerability CVE-2019-17632 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target (Eclipse Jetty 9.4.66.tuxcare0001) is NOT AFFECTED by CVE-2019-17632. The upstream vendor's fix (commits 9e40fc9a6fb and cf0df6e3ffd by Joakim Erdfelt, addressing Issue #4334) was already present in the upstream release version 9.4.58+ that TuxCare onboarded. The fix adds HTML/XML sanitization via StringUtil.sanitizeXmlString() to all exception messages and stack traces in both HTML ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17632" }, "impact_statement": "not_affected \u2014 The target (Eclipse Jetty 9.4.66.tuxcare0001) is NOT AFFECTED by CVE-2019-17632. The upstream vendor's fix (commits 9e40fc9a6fb and cf0df6e3ffd by Joakim Erdfelt, addressing Issue #4334) was already present in the upstream release version 9.4.58+ that TuxCare onboarded. The fix adds HTML/XML sanitization via StringUtil.sanitizeXmlString() to all exception messages and stack traces in both HTML ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2019-17638 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2019-17638 affects Eclipse Jetty 9.4.27 to 9.4.29 due to double-release of ByteBuffer on HEADER_OVERFLOW exception. The target version 9.4.66.tuxcare0001 is NOT affected because the upstream vendor fix (commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba by Greg Wilkins) was shipped in Jetty 9.4.30.v20200611 and inherited by the target. The vulnerable pattern (ByteBuffer released twice when response headers exceed capacity) is not present in the target code. All fix characteristics are verified: _chunk moved to SendCallback inner class, HEADER_OVERFLOW checks capacity before releasing, and helper methods releaseHeader()/releaseChunk() atomically release+null buffers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17638" }, "impact_statement": "CVE-2019-17638 affects Eclipse Jetty 9.4.27 to 9.4.29 due to double-release of ByteBuffer on HEADER_OVERFLOW exception. The target version 9.4.66.tuxcare0001 is NOT affected because the upstream vendor fix (commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba by Greg Wilkins) was shipped in Jetty 9.4.30.v20200611 and inherited by the target. The vulnerable pattern (ByteBuffer released twice when response headers exceed capacity) is not present in the target code. All fix characteristics are verified: _chunk moved to SendCallback inner class, HEADER_OVERFLOW checks capacity before releasing, and helper methods releaseHeader()/releaseChunk() atomically release+null buffers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-02T19:37:28.336698+00:00", "status_notes": "Vulnerability CVE-2020-27218 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 (GZIP request body inflation vulnerability) is NOT present in Jetty 9.4.66.tuxcare0001. The fix was introduced by upstream Jetty in commit 14f94f738df5adf68549749d01d4f9d97ea51452 (Issue #5605) and shipped in Jetty 9.4.35.v20201120 (November 2020). TuxCare onboarded Jetty starting with 9.4.58.1, which already contained the upstream fix. The defense mechanism (ensureConsumeAllOrNo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27218" }, "impact_statement": "not_affected \u2014 CVE-2020-27218 (GZIP request body inflation vulnerability) is NOT present in Jetty 9.4.66.tuxcare0001. The fix was introduced by upstream Jetty in commit 14f94f738df5adf68549749d01d4f9d97ea51452 (Issue #5605) and shipped in Jetty 9.4.35.v20201120 (November 2020). TuxCare onboarded Jetty starting with 9.4.58.1, which already contained the upstream fix. The defense mechanism (ensureConsumeAllOrNo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-02T19:30:41.513971+00:00", "status_notes": "Vulnerability CVE-2020-27223 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223 is a DoS vulnerability in Jetty's QuotedQualityCSV class where HTTP headers with many quality parameters cause excessive CPU usage due to an O(n\u00b2) bubble-sort algorithm. The target version 9.4.66 contains the upstream fix (commit 10e531756b9) that replaced the vulnerable sorting with an O(n log n) stream-based sort. This fix was included in upstream Jetty 9.4.37.v20210219, and Tu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27223" }, "impact_statement": "not_affected \u2014 CVE-2020-27223 is a DoS vulnerability in Jetty's QuotedQualityCSV class where HTTP headers with many quality parameters cause excessive CPU usage due to an O(n\u00b2) bubble-sort algorithm. The target version 9.4.66 contains the upstream fix (commit 10e531756b9) that replaced the vulnerable sorting with an O(n log n) stream-based sort. This fix was included in upstream Jetty 9.4.37.v20210219, and Tu..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2021-28165 affects version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2021-28165" }, "action_statement": "Vulnerability CVE-2021-28165 affects version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2021-34428 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 9.4.62 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.", "vulnerability": { "name": "CVE-2021-34428" }, "impact_statement": "Version 9.4.62 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-10T04:17:00.447062+00:00", "status_notes": "Vulnerability CVE-2022-2191 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its legacy buffer pool does not retain acquired buffers, so missed releases do not cause accumulating pool memory retention. Acquisition removes buffers from the free queue at jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:181, and new buffers are allocated without active-entry tracking at jetty-io/src/main/java/org/eclipse/jetty/io/ArrayByteBufferPool.java:123. Unreleased buffers can be garbage-collected, as documented at jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:34.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2022-2191" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its legacy buffer pool does not retain acquired buffers, so missed releases do not cause accumulating pool memory retention. Acquisition removes buffers from the free queue at jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:181, and new buffers are allocated without active-entry tracking at jetty-io/src/main/java/org/eclipse/jetty/io/ArrayByteBufferPool.java:123. Unreleased buffers can be garbage-collected, as documented at jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:34." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-06T07:27:00.031105+00:00", "status_notes": "Vulnerability CVE-2023-26048 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 9.4.66 already contains the upstream CVE-2023-26048 fix (PR #9345, merge c3021592218d, authored by lachlan@webtide.com). It adds a maxParts limit tied to ContextHandler.maxFormKeys in both multipart parsers. The first TuxCare commit in HEAD is a 9.4.58.1 setup commit, which comes after 9.4.51, so the fix shipped in the upstream release and is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26048" }, "impact_statement": "not_affected \u2014 Jetty 9.4.66 already contains the upstream CVE-2023-26048 fix (PR #9345, merge c3021592218d, authored by lachlan@webtide.com). It adds a maxParts limit tied to ContextHandler.maxFormKeys in both multipart parsers. The first TuxCare commit in HEAD is a 9.4.58.1 setup commit, which comes after 9.4.51, so the fix shipped in the upstream release and is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-06T07:26:00.061897+00:00", "status_notes": "Vulnerability CVE-2023-26049 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 9.4.66's CookieCutter already contains the upstream CVE-2023-26049 fix (PR #9352, commit 1be1401bafb, authored by gregw@webtide.com). The fix reached the repo through the upstream release, before the first TuxCare commit. A quoted cookie value can no longer swallow ';' delimiters under the default RFC6265 compliance.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26049" }, "impact_statement": "not_affected \u2014 Jetty 9.4.66's CookieCutter already contains the upstream CVE-2023-26049 fix (PR #9352, commit 1be1401bafb, authored by gregw@webtide.com). The fix reached the repo through the upstream release, before the first TuxCare commit. A quoted cookie value can no longer swallow ';' delimiters under the default RFC6265 compliance." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2024-13009 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. The target repository is NOT AFFECTED by CVE-2024-13009. The vulnerability has been fixed by upstream commit e3fa9466633db6bf36e0eb0d17e3de166c788ede (authored by gregw@webtide.com), which was already present in upstream release 9.4.58.1 that TuxCare onboarded. All patch changes are present in the target: buffer nulling on decompression errors (lines 187-188, 597-598), isError() guard in nextContent() (line 382), and direct interceptor calls without the removed intercept() wrapper (line 466).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-13009" }, "impact_statement": "The target repository is NOT AFFECTED by CVE-2024-13009. The vulnerability has been fixed by upstream commit e3fa9466633db6bf36e0eb0d17e3de166c788ede (authored by gregw@webtide.com), which was already present in upstream release 9.4.58.1 that TuxCare onboarded. All patch changes are present in the target: buffer nulling on decompression errors (lines 187-188, 597-598), isError() guard in nextContent() (line 382), and direct interceptor calls without the removed intercept() wrapper (line 466).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-11-10T04:17:00.447062+00:00", "status_notes": "Vulnerability CVE-2024-7708 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because empty request buffers are returned to the pool after zero-byte reads, preventing the memory leak. Both callers parse immediately after filling (jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:260 and :327). Parsing releases the empty buffer when no content references remain (:387), and the release method clears the connection\u2019s reference and returns the buffer to the pool (:224).", "vulnerability": { "name": "CVE-2024-7708" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because empty request buffers are returned to the pool after zero-byte reads, preventing the memory leak. Both callers parse immediately after filling (jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:260 and :327). Parsing releases the empty buffer when no content references remain (:387), and the release method clears the connection\u2019s reference and returns the buffer to the pool (:224)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2024-8184 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-8184" }, "impact_statement": "Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2026-10051 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Version 9.4.x uses a different architecture than the affected 11.x/12.x versions. The vulnerability requires a connection-scoped HttpConnection._trailers field that is never cleared between requests. Version 9.4.x instead uses HttpChannel-scoped _trailers that IS properly cleared in HttpChannel.recycle(), preventing cross-request trailer leakage.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-10051" }, "impact_statement": "not_affected \u2014 Version 9.4.x uses a different architecture than the affected 11.x/12.x versions. The vulnerability requires a connection-scoped HttpConnection._trailers field that is never cleared between requests. Version 9.4.x instead uses HttpChannel-scoped _trailers that IS properly cleared in HttpChannel.recycle(), preventing cross-request trailer leakage." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-12611" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1605" }, "impact_statement": "Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2026-18660 is fixed in version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-18660" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-19203" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-6790" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-76182" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-76184" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:30:48.716012+00:00", "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-77711" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.66.tuxcare0001" } } ], "timestamp": "2026-10-30T23:31:01.514561+00:00", "status_notes": "Vulnerability CVE-2026-95533 is fixed in version 9.4.66.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-95533" } } ] }