{
  "@id": "urn:uuid:c0f22f28-3a1c-4dfe-a95a-a539dcf001b0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T15:49:32.960958+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-09T15:49:32.960958+00:00",
      "status_notes": "Vulnerability CVE-2021-28169 does not affect version 9.4.59.tuxcare0004 of org.eclipse.jetty:jetty-servlets. Version 9.4.59 is not vulnerable. Summary: CVE-2021-28169 has been resolved in this repository. The ConcatServlet contains the necessary protections against double-encoded path attacks targeting WEB-INF and META-INF directories. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28169"
      },
      "impact_statement": "Version 9.4.59 is not vulnerable. Summary: CVE-2021-28169 has been resolved in this repository. The ConcatServlet contains the necessary protections against double-encoded path attacks targeting WEB-INF and META-INF directories. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-09T15:49:32.960958+00:00",
      "status_notes": "Vulnerability CVE-2023-36479 does not affect version 9.4.59.tuxcare0004 of org.eclipse.jetty:jetty-servlets. Version 9.4.59 is not vulnerable. Summary: CVE-2023-36479 mitigation has been applied. The CGI servlet has been deprecated and removed from all configurations. While the vulnerable code pattern still exists in the source code (command wrapping logic in CGI.java lines 346-359), the servlet is not configured or exposed in any web.xml files, preventing exploitation. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "vulnerability": {
        "name": "CVE-2023-36479"
      },
      "impact_statement": "Version 9.4.59 is not vulnerable. Summary: CVE-2023-36479 mitigation has been applied. The CGI servlet has been deprecated and removed from all configurations. While the vulnerable code pattern still exists in the source code (command wrapping logic in CGI.java lines 346-359), the servlet is not configured or exposed in any web.xml files, preventing exploitation. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-09T15:49:32.960958+00:00",
      "status_notes": "Vulnerability CVE-2024-6762 affects version 9.4.59.tuxcare0004 of org.eclipse.jetty:jetty-servlets.",
      "vulnerability": {
        "name": "CVE-2024-6762"
      },
      "action_statement": "Vulnerability CVE-2024-6762 affects version 9.4.59.tuxcare0004 of org.eclipse.jetty:jetty-servlets."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-09T15:49:32.960958+00:00",
      "status_notes": "Vulnerability CVE-2024-9823 does not affect version 9.4.59.tuxcare0004 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2024-9823 is not present in target version 9.4.59.tuxcare0003. The vulnerability involved DoSFilter's session tracking mode creating unbounded RateTracker objects bound to HttpSession objects, leading to OutOfMemory conditions. The upstream vendor (Jetty project) removed session tracking entirely in commit de862c558b1 (Oct 2023), included in release 9.4.54 (Feb 2024). TuxCare onboarded 9.4....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-9823"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-9823 is not present in target version 9.4.59.tuxcare0003. The vulnerability involved DoSFilter's session tracking mode creating unbounded RateTracker objects bound to HttpSession objects, leading to OutOfMemory conditions. The upstream vendor (Jetty project) removed session tracking entirely in commit de862c558b1 (Oct 2023), included in release 9.4.54 (Feb 2024). TuxCare onboarded 9.4...."
    }
  ]
}