{
  "@id": "urn:uuid:1e80db1c-fd98-4d63-b9a1-d6dfb4c960f5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T19:06:27.547498+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T19:06:27.547498+00:00",
      "status_notes": "Vulnerability CVE-2021-28169 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2021-28169 (double URL decoding vulnerability in ConcatServlet and WelcomeFilter) is NOT present in Jetty 11.0.18. The upstream fix (commit f58dbedcd05b2aee43c8faa709ba2deaa4361036 by Lachlan Roberts, May 2021) shipped in the upstream Jetty 11.0.18 release that TuxCare onboarded. Both servlets correctly prevent double decoding: ConcatServlet passes the original encoded string (not decoded p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28169"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28169 (double URL decoding vulnerability in ConcatServlet and WelcomeFilter) is NOT present in Jetty 11.0.18. The upstream fix (commit f58dbedcd05b2aee43c8faa709ba2deaa4361036 by Lachlan Roberts, May 2021) shipped in the upstream Jetty 11.0.18 release that TuxCare onboarded. Both servlets correctly prevent double decoding: ConcatServlet passes the original encoded string (not decoded p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T19:06:27.547498+00:00",
      "status_notes": "Vulnerability CVE-2023-36479 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2023-36479 concerns a command injection vulnerability in the Jetty CGI servlet's quote-wrapping logic (lines 339-340). The upstream vendor's response was to deprecate the CGI servlet (not to patch the vulnerability) in June 2023, with explicit guidance: \"No patch. The CGI Servlet should not be used.\" This deprecation shipped in upstream Jetty 11.0.18 (released October 2023). Target version ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-36479"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-36479 concerns a command injection vulnerability in the Jetty CGI servlet's quote-wrapping logic (lines 339-340). The upstream vendor's response was to deprecate the CGI servlet (not to patch the vulnerability) in June 2023, with explicit guidance: \"No patch. The CGI Servlet should not be used.\" This deprecation shipped in upstream Jetty 11.0.18 (released October 2023). Target version ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T19:06:27.547498+00:00",
      "status_notes": "Vulnerability CVE-2024-6762 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 Target version 11.0.18 already contains the upstream vendor's fix for CVE-2024-6762. Both PushSessionCacheFilter and PushCacheFilter are deprecated with warnings that they are \"example class not suitable for production.\" This deprecation was added by upstream Jetty developers (Lachlan Roberts, lachlan@webtide.com) in May-October 2023 and was included in the upstream Jetty 11.0.18 release before...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-6762"
      },
      "impact_statement": "not_affected \u2014 Target version 11.0.18 already contains the upstream vendor's fix for CVE-2024-6762. Both PushSessionCacheFilter and PushCacheFilter are deprecated with warnings that they are \"example class not suitable for production.\" This deprecation was added by upstream Jetty developers (Lachlan Roberts, lachlan@webtide.com) in May-October 2023 and was included in the upstream Jetty 11.0.18 release before..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T19:06:27.547498+00:00",
      "status_notes": "Vulnerability CVE-2024-9823 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 The target (Jetty 11.0.18) is NOT vulnerable to CVE-2024-9823. The vulnerability involved unbounded memory accumulation through session-based request tracking in DoSFilter, where RateTracker objects were stored in HTTP sessions via HttpSessionBindingListener without expiration. The fix removes session tracking entirely, switching to IP-based tracking only. This fix was included in upstream Jett...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-9823"
      },
      "impact_statement": "not_affected \u2014 The target (Jetty 11.0.18) is NOT vulnerable to CVE-2024-9823. The vulnerability involved unbounded memory accumulation through session-based request tracking in DoSFilter, where RateTracker objects were stored in HTTP sessions via HttpSessionBindingListener without expiration. The fix removes session tracking entirely, switching to IP-based tracking only. This fix was included in upstream Jett..."
    }
  ]
}