{
  "@id": "urn:uuid:183e158f-e526-4e33-b995-aa1cccd8468c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-common. The target repository (Jetty 11.0.31.tuxcare0001) is NOT vulnerable to CVE-2023-44487 (HTTP/2 Rapid Reset attack). The fix for this vulnerability was already present in the upstream Jetty release 11.0.26, which was onboarded by TuxCare in December 2025. The vulnerable code pattern (lack of RST_STREAM frame rate limiting) does not exist in the target because the upstream fix commit 0f246d12090 (authored by Simone Bordet on Oct 9, 2023) added rate control to RST_STREAM frames and was included in all Jetty 11.0.x releases from 11.0.26 onwards. The target version 11.0.31 inherits this protection from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (Jetty 11.0.31.tuxcare0001) is NOT vulnerable to CVE-2023-44487 (HTTP/2 Rapid Reset attack). The fix for this vulnerability was already present in the upstream Jetty release 11.0.26, which was onboarded by TuxCare in December 2025. The vulnerable code pattern (lack of RST_STREAM frame rate limiting) does not exist in the target because the upstream fix commit 0f246d12090 (authored by Simone Bordet on Oct 9, 2023) added rate control to RST_STREAM frames and was included in all Jetty 11.0.x releases from 11.0.26 onwards. The target version 11.0.31 inherits this protection from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 affects version 11.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "action_statement": "Vulnerability CVE-2024-22201 affects version 11.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-common."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@11.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-common. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-5115"
      },
      "impact_statement": "fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable"
    }
  ]
}