{
  "@id": "urn:uuid:4a1e0ab8-12b4-49e1-b244-54890d1da362",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.http2:http2-common. Target Jetty 9.4.63 is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The upstream fix (commit 0f246d12090fb15b7b21dee8429f459fd792de53 by Simone Bordet, Oct 2023) was already present in the upstream release before TuxCare onboarded this version. All defense mechanisms are active: rate control on RST_STREAM, CONTINUATION, SETTINGS, and invalid PUSH_PROMISE frames; header block capacity limits; and increased rate threshold to 128 events/second. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "Target Jetty 9.4.63 is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The upstream fix (commit 0f246d12090fb15b7b21dee8429f459fd792de53 by Simone Bordet, Oct 2023) was already present in the upstream release before TuxCare onboarded this version. All defense mechanisms are active: rate control on RST_STREAM, CONTINUATION, SETTINGS, and invalid PUSH_PROMISE frames; header block capacity limits; and increased rate threshold to 128 events/second. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.http2:http2-common. CVE-2024-22201 is not a vulnerability in version 9.4.63. The fix is already present in the code at jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/HTTP2Session.java lines 1888-1906, having been applied by upstream Eclipse Jetty in commit 86586df0a8a4d9c6b5af9a621ad1adf1b494d39b and first released in 9.4.54, from which 9.4.63 descends. The vulnerable pattern (returning false on the second idle timeout when the session is already closed, leaving TCP-congested connections in ESTABLISHED state until file descriptors are exhausted) has been removed: the already-closed branch of onIdleTimeout() now sets terminate = true and falls through to terminate(goAwayFrame), which closes the underlying connection. The HTTP/3 and QUIC code that the same upstream change also touched does not exist in the 9.4.x line.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "impact_statement": "CVE-2024-22201 is not a vulnerability in version 9.4.63. The fix is already present in the code at jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/HTTP2Session.java lines 1888-1906, having been applied by upstream Eclipse Jetty in commit 86586df0a8a4d9c6b5af9a621ad1adf1b494d39b and first released in 9.4.54, from which 9.4.63 descends. The vulnerable pattern (returning false on the second idle timeout when the session is already closed, leaving TCP-congested connections in ESTABLISHED state until file descriptors are exhausted) has been removed: the already-closed branch of onIdleTimeout() now sets terminate = true and falls through to terminate(goAwayFrame), which closes the underlying connection. The HTTP/3 and QUIC code that the same upstream change also touched does not exist in the 9.4.x line."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.http2:http2-common. CVE-2025-5115 (MadeYouReset) is NOT present in Jetty 9.4.63. The vulnerability's rate-limiting fix was already included in the upstream Jetty 9.4.63 release (commit 2daf58d2560 by Simone Bordet, August 2025). All three mitigation components are present and functional: (1) rate control on server-sent RST_STREAM frames, (2) rate control on WINDOW_UPDATE frames received for closed streams, and (3) rate control on invalid WINDOW_UPDATE frames with delta=0. The rate limit is configured to 128 events/second.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-5115"
      },
      "impact_statement": "CVE-2025-5115 (MadeYouReset) is NOT present in Jetty 9.4.63. The vulnerability's rate-limiting fix was already included in the upstream Jetty 9.4.63 release (commit 2daf58d2560 by Simone Bordet, August 2025). All three mitigation components are present and functional: (1) rate control on server-sent RST_STREAM frames, (2) rate control on WINDOW_UPDATE frames received for closed streams, and (3) rate control on invalid WINDOW_UPDATE frames with delta=0. The rate limit is configured to 128 events/second."
    }
  ]
}