{
  "@id": "urn:uuid:e3f70e3c-434e-4e88-9960-8b3352f7839f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T03:51:10.253584+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 affects version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "action_statement": "Vulnerability CVE-2020-27216 affects version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T03:51:10.253584+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164 affects Jetty 9.4.37-9.4.38, allowing percent-encoded dot segments (%2e, %2e%2e) in URIs to bypass WEB-INF protection. The vulnerability was fixed by upstream Jetty in versions 9.4.39 (March 2021) and 9.4.43 (June 2021). The target repository is at version 9.4.64, which includes the upstream fix. The normalization code in HttpURI (lines 857-872) applies URIUtil.canonicalPath() to...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164 affects Jetty 9.4.37-9.4.38, allowing percent-encoded dot segments (%2e, %2e%2e) in URIs to bypass WEB-INF protection. The vulnerability was fixed by upstream Jetty in versions 9.4.39 (March 2021) and 9.4.43 (June 2021). The target repository is at version 9.4.64, which includes the upstream fix. The normalization code in HttpURI (lines 857-872) applies URIUtil.canonicalPath() to..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T03:43:13.749002+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 is not present in this target. The vulnerability allowed attackers to access protected /WEB-INF/ directory content via URIs containing encoded characters (%u002e, %00, %u0000) that bypassed normalization. The upstream Jetty project fixed this in version 9.4.43 (June 2021) by: (1) rejecting encoded null bytes in HttpURI parsing, (2) adding canonicalization checks before resource a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 is not present in this target. The vulnerability allowed attackers to access protected /WEB-INF/ directory content via URIs containing encoded characters (%u002e, %00, %u0000) that bypassed normalization. The upstream Jetty project fixed this in version 9.4.43 (June 2021) by: (1) rejecting encoded null bytes in HttpURI parsing, (2) adding canonicalization checks before resource a..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    }
  ]
}