{
  "@id": "urn:uuid:2f35a2e4-d9e0-4a7f-aacb-5ad6fae74bd2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T19:07:00.143735+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-28169 does not affect version 11.0.19-tuxcare.2 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2021-28169 is NOT present in the target. The double-decoding vulnerability in ConcatServlet, WelcomeFilter, and ResourceService was fixed by upstream Jetty in version 11.0.3 (May 2021, commit f58dbedcd05). The target version 11.0.19 already contains this fix as it shipped in the upstream release that TuxCare onboarded in December 2023. All three affected components now properly encode paths...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28169"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28169 is NOT present in the target. The double-decoding vulnerability in ConcatServlet, WelcomeFilter, and ResourceService was fixed by upstream Jetty in version 11.0.3 (May 2021, commit f58dbedcd05). The target version 11.0.19 already contains this fix as it shipped in the upstream release that TuxCare onboarded in December 2023. All three affected components now properly encode paths..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-36479 does not affect version 11.0.19-tuxcare.2 of org.eclipse.jetty:jetty-servlets. Version 11.0.19 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2023-36479"
      },
      "impact_statement": "Version 11.0.19 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6762 affects version 11.0.19-tuxcare.2 of org.eclipse.jetty:jetty-servlets.",
      "vulnerability": {
        "name": "CVE-2024-6762"
      },
      "action_statement": "Vulnerability CVE-2024-6762 affects version 11.0.19-tuxcare.2 of org.eclipse.jetty:jetty-servlets."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T19:07:00.143735+00:00",
      "status_notes": "Vulnerability CVE-2024-9823 does not affect version 11.0.19-tuxcare.2 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2024-9823 DoSFilter memory exhaustion vulnerability is NOT present in target version 11.0.19. The vulnerable session-based request tracking mechanism was removed by upstream Jetty in version 11.0.18 (commit 168d8715d41, October 2023). The fix eliminated HttpSession-based RateTracker storage that could cause unbounded memory growth without proper session expiration. Target 11.0.19 inherits t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-9823"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-9823 DoSFilter memory exhaustion vulnerability is NOT present in target version 11.0.19. The vulnerable session-based request tracking mechanism was removed by upstream Jetty in version 11.0.18 (commit 168d8715d41, October 2023). The fix eliminated HttpSession-based RateTracker storage that could cause unbounded memory growth without proper session expiration. Target 11.0.19 inherits t..."
    }
  ]
}