{
  "@id": "urn:uuid:027c8e6b-7230-40f1-8fed-f560d65ccdae",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty.http2:http2-common. CVE-2023-44487 (HTTP/2 Rapid Reset) is NOT present in Jetty 9.4.61. The upstream fix (commit 0f246d12090fb15b7b21dee8429f459fd792de53) was included in Jetty 9.4.53.v20231009 and is therefore present in version 9.4.61. The fix adds rate control (128 events/second) to RST_STREAM, CONTINUATION, SETTINGS, and other HTTP/2 frames, plus buffer size limits on header accumulation. All defenses are active by default in the target code. This is an upstream fix authored by simone.bordet@gmail.com that shipped in the upstream release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset) is NOT present in Jetty 9.4.61. The upstream fix (commit 0f246d12090fb15b7b21dee8429f459fd792de53) was included in Jetty 9.4.53.v20231009 and is therefore present in version 9.4.61. The fix adds rate control (128 events/second) to RST_STREAM, CONTINUATION, SETTINGS, and other HTTP/2 frames, plus buffer size limits on header accumulation. All defenses are active by default in the target code. This is an upstream fix authored by simone.bordet@gmail.com that shipped in the upstream release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 affects version 9.4.61.tuxcare0002 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "action_statement": "Vulnerability CVE-2024-22201 affects version 9.4.61.tuxcare0002 of org.eclipse.jetty.http2:http2-common."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 is fixed in version 9.4.61.tuxcare0002 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2025-5115"
      }
    }
  ]
}