{
  "@id": "urn:uuid:5a8757ef-7ff9-46c6-b8aa-13faed9ee872",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty.http2:http2-common. CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in Jetty 9.4.64. The upstream fix commit 0f246d12090 \"Fixes #10679 - Review HTTP/2 rate control\" by Simone Bordet (Oct 9, 2023) is present in HEAD and was included in the upstream release before TuxCare onboarded this version. The fix adds comprehensive rate limiting to HTTP/2 frame processing (RST_STREAM, CONTINUATION, SETTINGS, invalid frames) and caps header block fragment accumulation to prevent resource exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in Jetty 9.4.64. The upstream fix commit 0f246d12090 \"Fixes #10679 - Review HTTP/2 rate control\" by Simone Bordet (Oct 9, 2023) is present in HEAD and was included in the upstream release before TuxCare onboarded this version. The fix adds comprehensive rate limiting to HTTP/2 frame processing (RST_STREAM, CONTINUATION, SETTINGS, invalid frames) and caps header block fragment accumulation to prevent resource exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 affects version 9.4.64.tuxcare0001 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "action_statement": "Vulnerability CVE-2024-22201 affects version 9.4.64.tuxcare0001 of org.eclipse.jetty.http2:http2-common."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 is fixed in version 9.4.64.tuxcare0001 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2025-5115"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 9.4.64.tuxcare0001 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 9.4.64.tuxcare0001 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    }
  ]
}