{ "@id": "urn:uuid:67b3fffc-a0cc-48d2-94dd-3dc8acf34c79", "role": "Document Creator", "author": "https://tuxcare.com", "version": 14, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T16:05:28.850476+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001" } } ], "timestamp": "2026-09-30T13:01:01.522418+00:00", "status_notes": "Vulnerability CVE-2021-28169 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-servlets. Version 9.4.60 is not vulnerable. Summary: CVE-2021-28169 has been patched in the target repository. The ConcatServlet now properly validates paths before dispatching, preventing double-encoded path traversal attacks to access WEB-INF/META-INF protected resources. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-28169" }, "impact_statement": "Version 9.4.60 is not vulnerable. Summary: CVE-2021-28169 has been patched in the target repository. The ConcatServlet now properly validates paths before dispatching, preventing double-encoded path traversal attacks to access WEB-INF/META-INF protected resources. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001" } } ], "timestamp": "2026-09-30T13:01:01.522418+00:00", "status_notes": "Vulnerability CVE-2023-36479 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-servlets.", "vulnerability": { "name": "CVE-2023-36479" }, "action_statement": "Vulnerability CVE-2023-36479 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-servlets." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001" } } ], "timestamp": "2026-09-30T13:01:01.522418+00:00", "status_notes": "Vulnerability CVE-2024-6762 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-servlets.", "vulnerability": { "name": "CVE-2024-6762" }, "action_statement": "Vulnerability CVE-2024-6762 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-servlets." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001" } } ], "timestamp": "2026-11-02T19:11:00.084109+00:00", "status_notes": "Vulnerability CVE-2024-9823 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2024-9823 is NOT present in target version 9.4.65. The vulnerability involved DoSFilter's session tracking mode allowing unbounded memory growth leading to OutOfMemory errors. The upstream fix (commit de862c558b1, introduced in Jetty 9.4.54) completely removed session tracking functionality. This fix was already present in the upstream release that TuxCare onboarded, making the target versi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-9823" }, "impact_statement": "not_affected \u2014 CVE-2024-9823 is NOT present in target version 9.4.65. The vulnerability involved DoSFilter's session tracking mode allowing unbounded memory growth leading to OutOfMemory errors. The upstream fix (commit de862c558b1, introduced in Jetty 9.4.54) completely removed session tracking functionality. This fix was already present in the upstream release that TuxCare onboarded, making the target versi..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001" } } ], "timestamp": "2026-09-30T13:01:01.522418+00:00", "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-servlets.", "vulnerability": { "name": "CVE-2026-12611" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001" } } ], "timestamp": "2026-09-30T13:01:01.522418+00:00", "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-servlets.", "vulnerability": { "name": "CVE-2026-19203" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001" } } ], "timestamp": "2026-09-30T13:35:44.733301+00:00", "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-servlets.", "vulnerability": { "name": "CVE-2026-76182" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001" } } ], "timestamp": "2026-09-30T13:35:44.733301+00:00", "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-servlets.", "vulnerability": { "name": "CVE-2026-76184" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.65.tuxcare0001" } } ], "timestamp": "2026-09-30T13:35:44.733301+00:00", "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-servlets.", "vulnerability": { "name": "CVE-2026-77711" } } ] }