{
  "@id": "urn:uuid:df80a992-4b3e-4345-a286-73fbf99740f4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T19:07:00.143735+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-28169 does not affect version 11.0.27.tuxcare0004 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2021-28169 does not affect this version. The double-decoding vulnerability in ConcatServlet and WelcomeFilter was fixed in upstream commit 1c05b0bcb181c759e98b060bded0b9376976b055 (Fixes #6263) by author lachlan@webtide.com. This fix was already present in upstream release 11.0.26, which TuxCare onboarded via commit 36280f393a1 (\"setup 11.0.26\"). The target version 11.0.27 inherits this ups...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28169"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28169 does not affect this version. The double-decoding vulnerability in ConcatServlet and WelcomeFilter was fixed in upstream commit 1c05b0bcb181c759e98b060bded0b9376976b055 (Fixes #6263) by author lachlan@webtide.com. This fix was already present in upstream release 11.0.26, which TuxCare onboarded via commit 36280f393a1 (\"setup 11.0.26\"). The target version 11.0.27 inherits this ups..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-36479 does not affect version 11.0.27.tuxcare0004 of org.eclipse.jetty:jetty-servlets. Version 11.0.27 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2023-36479"
      },
      "impact_statement": "Version 11.0.27 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6762 affects version 11.0.27.tuxcare0004 of org.eclipse.jetty:jetty-servlets.",
      "vulnerability": {
        "name": "CVE-2024-6762"
      },
      "action_statement": "Vulnerability CVE-2024-6762 affects version 11.0.27.tuxcare0004 of org.eclipse.jetty:jetty-servlets."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-02T19:07:00.143735+00:00",
      "status_notes": "Vulnerability CVE-2024-9823 does not affect version 11.0.27.tuxcare0004 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2024-9823 affects Jetty's DoSFilter session tracking mode, which could cause OutOfMemory errors through unbounded accumulation of RateTracker objects in HttpSession storage. The target version 11.0.27 already contains the upstream fix (commit 168d8715d41 by Greg Wilkins) that removes session tracking entirely and uses only IP-based tracking with scheduled cleanup. This fix was shipped in up...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-9823"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-9823 affects Jetty's DoSFilter session tracking mode, which could cause OutOfMemory errors through unbounded accumulation of RateTracker objects in HttpSession storage. The target version 11.0.27 already contains the upstream fix (commit 168d8715d41 by Greg Wilkins) that removes session tracking entirely and uses only IP-based tracking with scheduled cleanup. This fix was shipped in up..."
    }
  ]
}