{
  "@id": "urn:uuid:b118eeec-bf11-44be-92db-b9fe4b634839",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T00:56:31.713844+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.0.26-tuxcare.1 of org.eclipse.jetty.http2:http2-common. CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in this target. The vulnerability was fixed by upstream commit 0f246d12090fb15b7b21dee8429f459fd792de53 (authored by Simone Bordet) which was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded. The target contains all rate control defenses from the upstream fix: rate limiting on RST_STREAM, CONTINUATION, SETTINGS, and PUSH_PROMISE frames, plus header block accumulation caps. Verdict: not_affected with upstream fix attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in this target. The vulnerability was fixed by upstream commit 0f246d12090fb15b7b21dee8429f459fd792de53 (authored by Simone Bordet) which was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded. The target contains all rate control defenses from the upstream fix: rate limiting on RST_STREAM, CONTINUATION, SETTINGS, and PUSH_PROMISE frames, plus header block accumulation caps. Verdict: not_affected with upstream fix attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "action_statement": "Vulnerability CVE-2024-22201 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.http2:http2-common."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:31.713844+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.http2:http2-common, and is fixed in 10.0.26-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2025-5115"
      },
      "action_statement": "Vulnerability CVE-2025-5115 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.http2:http2-common, and is fixed in 10.0.26-tuxcare.4."
    }
  ]
}