{
  "@id": "urn:uuid:f197668a-0844-4f5a-9978-0f7c967689c0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T18:04:40.428853+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "action_statement": "Vulnerability CVE-2006-6969 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:41:42.084809+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "action_statement": "Vulnerability CVE-2011-4461 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "action_statement": "Vulnerability CVE-2015-2080 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "action_statement": "Vulnerability CVE-2016-4800 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "action_statement": "Vulnerability CVE-2017-7656 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "action_statement": "Vulnerability CVE-2017-7658 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "action_statement": "Vulnerability CVE-2017-9735 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T18:04:40.428853+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp. not_affected \u2014 CVE-2018-12536 (server filesystem path disclosure via InvalidPathException) is NOT present in target version 11.0.28. The vulnerability pattern was removed by upstream Jetty fixes (commits ad4dceb1c08 and 53e8bc2a636) that shipped in Jetty 11.0.26 before TuxCare onboarded the version. ResourceContentFactory.getContent() wraps all resource-loading exceptions in a try-catch block and re-throws sa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 (server filesystem path disclosure via InvalidPathException) is NOT present in target version 11.0.28. The vulnerability pattern was removed by upstream Jetty fixes (commits ad4dceb1c08 and 53e8bc2a636) that shipped in Jetty 11.0.26 before TuxCare onboarded the version. ResourceContentFactory.getContent() wraps all resource-loading exceptions in a try-catch block and re-throws sa..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "action_statement": "Vulnerability CVE-2018-12545 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T16:04:52.319065+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp. not_affected \u2014 The target Eclipse Jetty 11.0.28 is not affected by CVE-2019-10241. The XSS vulnerability in directory listings was fixed in upstream commit ca77bd384a2 (April 2019) by Joakim Erdfelt, which was already included in the upstream release before TuxCare onboarded version 11.0.26. The fix adds proper query parameter validation and HTML escaping to prevent malicious JavaScript injection via speciall...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 The target Eclipse Jetty 11.0.28 is not affected by CVE-2019-10241. The XSS vulnerability in directory listings was fixed in upstream commit ca77bd384a2 (April 2019) by Joakim Erdfelt, which was already included in the upstream release before TuxCare onboarded version 11.0.26. The fix adds proper query parameter validation and HTML escaping to prevent malicious JavaScript injection via speciall..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "action_statement": "Vulnerability CVE-2019-10246 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T16:27:26.409965+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp. not_affected \u2014 CVE-2019-10247 affects Jetty versions that expose filesystem directory paths in DefaultHandler's 404 error pages. Target version 11.0.28 is not affected because the upstream fix (commit d983890d1769744e7da865de7ff34065fe491a28 by Joakim Erdfelt, April 2019) was already present in the upstream release before TuxCare onboarding. The current code displays only context path, display name, availabil...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 affects Jetty versions that expose filesystem directory paths in DefaultHandler's 404 error pages. Target version 11.0.28 is not affected because the upstream fix (commit d983890d1769744e7da865de7ff34065fe491a28 by Joakim Erdfelt, April 2019) was already present in the upstream release before TuxCare onboarding. The current code displays only context path, display name, availabil..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "action_statement": "Vulnerability CVE-2019-17632 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "action_statement": "Vulnerability CVE-2019-17638 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "action_statement": "Vulnerability CVE-2020-27218 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "action_statement": "Vulnerability CVE-2020-27223 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "action_statement": "Vulnerability CVE-2021-28165 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:22:00.101796+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp. not_affected \u2014 CVE-2021-34428: Target repository is NOT AFFECTED. The vulnerability (session ID not invalidated when SessionListener#sessionDestroyed() throws exception) was fixed in upstream Jetty commit 087f486b446 (Issue #6277) by Jan Bartel. This fix was already present in upstream Jetty 11.0.26 before TuxCare onboarded the version. The target at commit e45f928f28c (version 11.0.28.tuxcare0005) contains t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34428: Target repository is NOT AFFECTED. The vulnerability (session ID not invalidated when SessionListener#sessionDestroyed() throws exception) was fixed in upstream Jetty commit 087f486b446 (Issue #6277) by Jan Bartel. This fix was already present in upstream Jetty 11.0.26 before TuxCare onboarded the version. The target at commit e45f928f28c (version 11.0.28.tuxcare0005) contains t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T14:49:00.142928+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp. not_affected \u2014 CVE-2022-2047 affects Jetty's HttpURI class parsing of URIs with semicolons in ambiguous positions (e.g., http://localhost;/path). The vulnerability was fixed in Jetty 11.0.10 by upstream commit d1e64f469362bb9371d530cccded5ecb13fa1cb5 (authored by Simone Bordet). The target repository is version 11.0.28.tuxcare0005, onboarded by TuxCare from upstream version 11.0.26, which already contained th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2047 affects Jetty's HttpURI class parsing of URIs with semicolons in ambiguous positions (e.g., http://localhost;/path). The vulnerability was fixed in Jetty 11.0.10 by upstream commit d1e64f469362bb9371d530cccded5ecb13fa1cb5 (authored by Simone Bordet). The target repository is version 11.0.28.tuxcare0005, onboarded by TuxCare from upstream version 11.0.26, which already contained th..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "action_statement": "Vulnerability CVE-2022-2191 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:37:56.759475+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp. not_affected \u2014 Target Jetty 11.0.28 is NOT AFFECTED by CVE-2023-26048. The upstream fix (commit a5344d7a260 by Lachlan Roberts) was already present in the upstream Jetty 11.0.28 release before TuxCare onboarded it. Both required protections are in place: (1) maximum part count limit (default 1000) prevents memory exhaustion from too many multipart parts, and (2) form content size tracking (default 200KB) prev...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 11.0.28 is NOT AFFECTED by CVE-2023-26048. The upstream fix (commit a5344d7a260 by Lachlan Roberts) was already present in the upstream Jetty 11.0.28 release before TuxCare onboarded it. Both required protections are in place: (1) maximum part count limit (default 1000) prevents memory exhaustion from too many multipart parts, and (2) form content size tracking (default 200KB) prev..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:10:02.627231+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp. not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values with semicolons) does not affect Jetty 11.0.28.tuxcare0005. The upstream fix (commit 7b8c2c1bf08, authored by Simone Bordet) was included in Jetty 11.0.15 (Feb 2023) and shipped in the upstream release that TuxCare onboarded for version 11.0.26. The target's RFC6265CookieParser correctly rejects cookies containing semicolons within quoted value...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values with semicolons) does not affect Jetty 11.0.28.tuxcare0005. The upstream fix (commit 7b8c2c1bf08, authored by Simone Bordet) was included in Jetty 11.0.15 (Feb 2023) and shipped in the upstream release that TuxCare onboarded for version 11.0.26. The target's RFC6265CookieParser correctly rejects cookies containing semicolons within quoted value..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:49:43.700401+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp. not_affected \u2014 CVE-2023-40167: Target is NOT AFFECTED. The vulnerability (accepting '+' prefix in Content-Length header values) was fixed in upstream Jetty commit e4d596eafc8 by Joakim Erdfelt, which was already included in Jetty 11.0.26. TuxCare onboarded version 11.0.26 with this fix already present. The target's convertContentLength() method (lines 1114-1131 in HttpParser.java) correctly validates each cha...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-40167: Target is NOT AFFECTED. The vulnerability (accepting '+' prefix in Content-Length header values) was fixed in upstream Jetty commit e4d596eafc8 by Joakim Erdfelt, which was already included in Jetty 11.0.26. TuxCare onboarded version 11.0.26 with this fix already present. The target's convertContentLength() method (lines 1114-1131 in HttpParser.java) correctly validates each cha..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "action_statement": "Vulnerability CVE-2024-13009 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "impact_statement": "fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "action_statement": "Vulnerability CVE-2024-7708 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp. Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 is fixed in version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp. not_affected \u2014 Jetty 11.0.28 is not affected by CVE-2026-10051. The vulnerability describes trailer leakage in Jetty 12.x's redesigned internal.HttpConnection where the _trailers field was never cleared between requests. Jetty 11.0.28 has a fundamentally different architecture where _trailers exists in HttpChannelOverHttp and is properly cleared via the established recycle() mechanism between HTTP/1.1 keep-al...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.28 is not affected by CVE-2026-10051. The vulnerability describes trailer leakage in Jetty 12.x's redesigned internal.HttpConnection where the _trailers field was never cleared between requests. Jetty 11.0.28 has a fundamentally different architecture where _trailers exists in HttpChannelOverHttp and is properly cleared via the established recycle() mechanism between HTTP/1.1 keep-al..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp. Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T09:43:02.853292+00:00",
      "status_notes": "Vulnerability CVE-2026-18660 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2026-18660"
      },
      "action_statement": "Vulnerability CVE-2026-18660 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp, and is fixed in 11.0.28.tuxcare0001.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      },
      "action_statement": "Vulnerability CVE-2026-2332 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp, and is fixed in 11.0.28.tuxcare0001."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp, and is fixed in 11.0.28.tuxcare0004.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "action_statement": "Vulnerability CVE-2026-6790 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp, and is fixed in 11.0.28.tuxcare0004."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.demos:demo-proxy-webapp. not_affected \u2014 Jetty 11.0.28 is not affected by CVE-2026-8384. While the target contains similar semicolon-handling code in decodePath() that doesn't update the character tracking variable, the vulnerability does not manifest due to architectural differences. Jetty 11 uses a two-stage normalization process (decodePath then canonicalPath) where the path is always fully normalized before security checks, unlike...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.28 is not affected by CVE-2026-8384. While the target contains similar semicolon-handling code in decodePath() that doesn't update the character tracking variable, the vulnerability does not manifest due to architectural differences. Jetty 11 uses a two-stage normalization process (decodePath then canonicalPath) where the path is always fully normalized before security checks, unlike..."
    }
  ]
}