{
  "@id": "urn:uuid:f9062118-fe95-4976-b867-a2263a70a713",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.http2:http2-common. CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in Jetty 11.0.28. The upstream vendor fix (commit 0f246d12090 by simone.bordet@gmail.com, dated 2023-10-09) was already included in the upstream Jetty 11.0.26 release that TuxCare onboarded in December 2025. All defense mechanisms are present and active by default: (1) Rate control on RST_STREAM frames at 128 events/s, (2) Rate control on CONTINUATION, SETTINGS, and PUSH_PROMISE frames, (3) Capacity limits on header block fragment accumulation (maxCapacity checks). The vulnerable pattern does not exist in the target because the upstream fix shipped before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in Jetty 11.0.28. The upstream vendor fix (commit 0f246d12090 by simone.bordet@gmail.com, dated 2023-10-09) was already included in the upstream Jetty 11.0.26 release that TuxCare onboarded in December 2025. All defense mechanisms are present and active by default: (1) Rate control on RST_STREAM frames at 128 events/s, (2) Rate control on CONTINUATION, SETTINGS, and PUSH_PROMISE frames, (3) Capacity limits on header block fragment accumulation (maxCapacity checks). The vulnerable pattern does not exist in the target because the upstream fix shipped before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "action_statement": "Vulnerability CVE-2024-22201 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty.http2:http2-common."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty.http2:http2-common. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-5115"
      },
      "impact_statement": "fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable"
    }
  ]
}