{
  "@id": "urn:uuid:793e8b54-2d1f-4825-9a76-c7d9fb4bfc14",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@11.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@11.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2023-36478 does not affect version 11.0.27.tuxcare0004 of org.eclipse.jetty.http2:http2-hpack. CVE-2023-36478: The target Jetty 11.0.27.tuxcare0005 is NOT AFFECTED. The vulnerable integer overflow in MetaDataBuilder.checkSize has been fixed by upstream commit c7a4b05fc735e73e7522cb617c079045b709957b, which shipped in the upstream release before TuxCare's onboarding. The vulnerable checkSize(int length, boolean huffman) method that performed unchecked (length * 4) / 3 multiplication is completely absent. The replacement integerDecode method explicitly validates: if (decodedInt < 0) throw EncodingException, preventing negative lengths from integer overflow from being used in buffer allocations. Fix author: lachlan@webtide.com (upstream, not TuxCare).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53), NVD (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16), cve.org (>= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53), Snyk (>= 9.3.0, < 9.4.53.v20231009; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53.v20231009; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-36478"
      },
      "impact_statement": "CVE-2023-36478: The target Jetty 11.0.27.tuxcare0005 is NOT AFFECTED. The vulnerable integer overflow in MetaDataBuilder.checkSize has been fixed by upstream commit c7a4b05fc735e73e7522cb617c079045b709957b, which shipped in the upstream release before TuxCare's onboarding. The vulnerable checkSize(int length, boolean huffman) method that performed unchecked (length * 4) / 3 multiplication is completely absent. The replacement integerDecode method explicitly validates: if (decodedInt < 0) throw EncodingException, preventing negative lengths from integer overflow from being used in buffer allocations. Fix author: lachlan@webtide.com (upstream, not TuxCare).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53), NVD (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16), cve.org (>= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53), Snyk (>= 9.3.0, < 9.4.53.v20231009; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53.v20231009; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16)."
    }
  ]
}