{
  "@id": "urn:uuid:6cdcea77-c622-4e2b-959f-c04c873069da",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty.http2:http2-common. Target Jetty 10.0.28 is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset). All defenses from the upstream vendor patch are already present in the target code: (1) rate control on RST_STREAM, CONTINUATION, SETTINGS, and invalid PUSH_PROMISE/HEADERS frames via rateControlOnEvent() checks; (2) HeaderBlockFragments buffer capacity limits preventing unbounded memory growth; (3) default rate control factory set to 128 events/second. The fix commit dbb94514dc9 by Simone Bordet was shipped in upstream Jetty 10.0.17 (October 2023), well before TuxCare onboarded version 10.0.26 (December 2025). The vulnerability pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "Target Jetty 10.0.28 is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset). All defenses from the upstream vendor patch are already present in the target code: (1) rate control on RST_STREAM, CONTINUATION, SETTINGS, and invalid PUSH_PROMISE/HEADERS frames via rateControlOnEvent() checks; (2) HeaderBlockFragments buffer capacity limits preventing unbounded memory growth; (3) default rate control factory set to 128 events/second. The fix commit dbb94514dc9 by Simone Bordet was shipped in upstream Jetty 10.0.17 (October 2023), well before TuxCare onboarded version 10.0.26 (December 2025). The vulnerability pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 affects version 10.0.28.tuxcare0001 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "action_statement": "Vulnerability CVE-2024-22201 affects version 10.0.28.tuxcare0001 of org.eclipse.jetty.http2:http2-common."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.28.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.28.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 does not affect version 10.0.28.tuxcare0001 of org.eclipse.jetty.http2:http2-common. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-5115"
      },
      "impact_statement": "fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable"
    }
  ]
}