{
  "@id": "urn:uuid:6a2d2b20-c0b3-4e2b-821c-5001c0108952",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 27,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.26-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.26-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 11.0.26-tuxcare.3 of org.eclipse.jetty:jetty-webapp. Target Jetty 11.0.26 is not affected by CVE-2020-27216. The vulnerable race condition in temporary directory creation (create-file-then-delete-then-mkdir pattern) is not present in the target code. The upstream fix (commit 53e0e0e9b25 by Joakim Erdfelt) replaced the vulnerable pattern with atomic Files.createTempDirectory() calls and was already included in Jetty 11.0.26 when TuxCare onboarded this version. Both temp directory creation sites (WebInfConfiguration.java lines 104 and 236) use the secure implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "Target Jetty 11.0.26 is not affected by CVE-2020-27216. The vulnerable race condition in temporary directory creation (create-file-then-delete-then-mkdir pattern) is not present in the target code. The upstream fix (commit 53e0e0e9b25 by Joakim Erdfelt) replaced the vulnerable pattern with atomic Files.createTempDirectory() calls and was already included in Jetty 11.0.26 when TuxCare onboarded this version. Both temp directory creation sites (WebInfConfiguration.java lines 104 and 236) use the secure implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.26-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.26-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T03:45:36.702505+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 11.0.26-tuxcare.3 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164 is not present in the target Jetty 11.0.26 repository. The vulnerability, which allowed percent-encoded dot segments (%2e, %2e%2e) to bypass path normalization and access protected resources like WEB-INF, has been fixed by upstream commits that shipped in the Jetty 11.0.26 release before TuxCare onboarded it. The fix includes: (1) HttpURI detecting and flagging ambiguous path seg...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164 is not present in the target Jetty 11.0.26 repository. The vulnerability, which allowed percent-encoded dot segments (%2e, %2e%2e) to bypass path normalization and access protected resources like WEB-INF, has been fixed by upstream commits that shipped in the Jetty 11.0.26 release before TuxCare onboarded it. The fix includes: (1) HttpURI detecting and flagging ambiguous path seg..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.26-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.26-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T03:42:02.973774+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 11.0.26-tuxcare.3 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 is NOT present in target Jetty 11.0.26-tuxcare.3. The vulnerability (URI encoding bypass allowing WEB-INF access via %u002e or %00 sequences) was fixed by upstream Eclipse Jetty in commit f045b5a3bad (Issue #6473), which shipped in release 11.0.26 before TuxCare onboarded the version. All three critical defenses are confirmed active: (1) null byte rejection in HttpURI.java:1324-1...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 is NOT present in target Jetty 11.0.26-tuxcare.3. The vulnerability (URI encoding bypass allowing WEB-INF access via %u002e or %00 sequences) was fixed by upstream Eclipse Jetty in commit f045b5a3bad (Issue #6473), which shipped in release 11.0.26 before TuxCare onboarded the version. All three critical defenses are confirmed active: (1) null byte rejection in HttpURI.java:1324-1..."
    }
  ]
}