{
  "@id": "urn:uuid:47d9ea67-6c17-45ad-909d-c6121c217946",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.62.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.62.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.62.tuxcare0002 of org.eclipse.jetty.http2:http2-common. The target repository (Jetty 9.4.62) is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The vulnerability pattern\u2014absence of rate limiting on HTTP/2 frame processing (RST_STREAM, CONTINUATION, SETTINGS)\u2014is not present because the upstream vendor fix (commit 0f246d12090 by simone.bordet@gmail.com) was already included in the Jetty release that TuxCare onboarded. The fix adds rateControlOnEvent() checks to prevent rapid frame submission attacks and limits header block buffer growth. The fix was shipped in the upstream release 422 commits before TuxCare's first commit (d8aedf0e4210), making this an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (Jetty 9.4.62) is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The vulnerability pattern\u2014absence of rate limiting on HTTP/2 frame processing (RST_STREAM, CONTINUATION, SETTINGS)\u2014is not present because the upstream vendor fix (commit 0f246d12090 by simone.bordet@gmail.com) was already included in the Jetty release that TuxCare onboarded. The fix adds rateControlOnEvent() checks to prevent rapid frame submission attacks and limits header block buffer growth. The fix was shipped in the upstream release 422 commits before TuxCare's first commit (d8aedf0e4210), making this an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.62.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.62.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 affects version 9.4.62.tuxcare0002 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "action_statement": "Vulnerability CVE-2024-22201 affects version 9.4.62.tuxcare0002 of org.eclipse.jetty.http2:http2-common."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.62.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.62.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 is fixed in version 9.4.62.tuxcare0002 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2025-5115"
      }
    }
  ]
}