{
  "@id": "urn:uuid:1afb6de1-825b-4dac-b49f-e59b027875e7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T19:10:00.166570+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-28169 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-servlets. Version 9.4.60 is not vulnerable. Summary: CVE-2021-28169 has been patched in the target repository. The ConcatServlet now properly validates paths before dispatching, preventing double-encoded path traversal attacks to access WEB-INF/META-INF protected resources. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28169"
      },
      "impact_statement": "Version 9.4.60 is not vulnerable. Summary: CVE-2021-28169 has been patched in the target repository. The ConcatServlet now properly validates paths before dispatching, preventing double-encoded path traversal attacks to access WEB-INF/META-INF protected resources. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-36479 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 The upstream vendor (Eclipse Jetty) applied their chosen mitigation for CVE-2023-36479 by deprecating the entire CGI servlet class in commit ec7e1fd173 (June 2023). While the vulnerable escaping code remains present at lines 350-351, the vendor's official position is \"do not use, no replacement, will be removed in a future release.\" The @Deprecated annotation and removal from test configuration...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-36479"
      },
      "impact_statement": "not_affected \u2014 The upstream vendor (Eclipse Jetty) applied their chosen mitigation for CVE-2023-36479 by deprecating the entire CGI servlet class in commit ec7e1fd173 (June 2023). While the vulnerable escaping code remains present at lines 350-351, the vendor's official position is \"do not use, no replacement, will be removed in a future release.\" The @Deprecated annotation and removal from test configuration..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6762 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2024-6762 affects Jetty's PushSessionCacheFilter and PushCacheFilter due to unbounded cache growth leading to memory exhaustion. The target repository (Jetty 9.4.63, commit 7267af07102) contains the upstream vendor's fix, which deprecates both filters and adds explicit warnings that they are \"example class not suitable for production.\" The fix was authored by upstream Jetty developer Lachla...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-6762"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-6762 affects Jetty's PushSessionCacheFilter and PushCacheFilter due to unbounded cache growth leading to memory exhaustion. The target repository (Jetty 9.4.63, commit 7267af07102) contains the upstream vendor's fix, which deprecates both filters and adds explicit warnings that they are \"example class not suitable for production.\" The fix was authored by upstream Jetty developer Lachla..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:10:00.166570+00:00",
      "status_notes": "Vulnerability CVE-2024-9823 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 Target version 9.4.63 is not affected by CVE-2024-9823. The vulnerability (unbounded memory accumulation via session-based rate tracking in DoSFilter) was fixed in upstream Jetty 9.4.54 (October 2023) by commit de862c558b1, authored by gregw@webtide.com. This fix shipped in the upstream release that TuxCare later onboarded. The target contains no session tracking code, no HttpSessionBindingList...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-9823"
      },
      "impact_statement": "not_affected \u2014 Target version 9.4.63 is not affected by CVE-2024-9823. The vulnerability (unbounded memory accumulation via session-based rate tracking in DoSFilter) was fixed in upstream Jetty 9.4.54 (October 2023) by commit de862c558b1, authored by gregw@webtide.com. This fix shipped in the upstream release that TuxCare later onboarded. The target contains no session tracking code, no HttpSessionBindingList..."
    }
  ]
}