{
  "@id": "urn:uuid:7c397063-2a09-465c-b285-9618dfab9b8a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.26-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.26-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 11.0.26-tuxcare.3 of org.eclipse.jetty.http2:http2-common. The target repository (Jetty 11.0.26-tuxcare.3) is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset). All required fixes for rate control on HTTP/2 control frames (RST_STREAM, CONTINUATION, SETTINGS, PUSH_PROMISE) and header block fragment capacity limits are present in the code. The fix was authored by Simone Bordet (upstream Jetty developer) in commit 0f246d12090 on 2023-10-09 and was included in the upstream Jetty 11.0.26 release. When TuxCare onboarded version 11.0.26 (setup commit 804520a9c0c on 2025-12-12), the fix was already present in the upstream code. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (Jetty 11.0.26-tuxcare.3) is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset). All required fixes for rate control on HTTP/2 control frames (RST_STREAM, CONTINUATION, SETTINGS, PUSH_PROMISE) and header block fragment capacity limits are present in the code. The fix was authored by Simone Bordet (upstream Jetty developer) in commit 0f246d12090 on 2023-10-09 and was included in the upstream Jetty 11.0.26 release. When TuxCare onboarded version 11.0.26 (setup commit 804520a9c0c on 2025-12-12), the fix was already present in the upstream code. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.26-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.26-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T21:23:09.624628+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "action_statement": "Vulnerability CVE-2024-22201 affects version 11.0.26-tuxcare.3 of org.eclipse.jetty.http2:http2-common."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.26-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.26-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T21:23:09.624628+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 does not affect version 11.0.26-tuxcare.3 of org.eclipse.jetty.http2:http2-common. Version 11.0.26 is not vulnerable. Summary: CVE-2025-5115 (MadeYouReset) vulnerability patterns exist in the codebase (HTTP/2 WINDOW_UPDATE with delta==0, window overflow, and DATA frames on half-closed streams all trigger RST_STREAM from server), BUT the mitigation has been applied via commit a05e1d031d0 which implements rate control on server-sent RST_STREAM frames (default 128/second limit), preventing the DoS attack. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "vulnerability": {
        "name": "CVE-2025-5115"
      },
      "impact_statement": "Version 11.0.26 is not vulnerable. Summary: CVE-2025-5115 (MadeYouReset) vulnerability patterns exist in the codebase (HTTP/2 WINDOW_UPDATE with delta==0, window overflow, and DATA frames on half-closed streams all trigger RST_STREAM from server), BUT the mitigation has been applied via commit a05e1d031d0 which implements rate control on server-sent RST_STREAM frames (default 128/second limit), preventing the DoS attack. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    }
  ]
}