{
  "@id": "urn:uuid:94fd216e-793f-46c6-ab85-c317ed566d63",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@11.0.29.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@11.0.29.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2023-36478 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty.http2:http2-hpack. CVE-2023-36478 affects Jetty versions before 11.0.16 through an integer overflow vulnerability in MetaDataBuilder.checkSize() method. The target version 11.0.29.tuxcare0004 is not affected because the vulnerable code pattern was completely removed by upstream refactoring that shipped in Jetty 11.0.16 (August 2023), well before TuxCare began maintaining this version line from 11.0.26 (December 2025). The fix replaced the vulnerable checkSize() method with a safer architecture that validates header sizes after decoding using actual string lengths, eliminating the integer overflow attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53), NVD (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16), cve.org (>= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53), Snyk (>= 9.3.0, < 9.4.53.v20231009; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53.v20231009; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-36478"
      },
      "impact_statement": "CVE-2023-36478 affects Jetty versions before 11.0.16 through an integer overflow vulnerability in MetaDataBuilder.checkSize() method. The target version 11.0.29.tuxcare0004 is not affected because the vulnerable code pattern was completely removed by upstream refactoring that shipped in Jetty 11.0.16 (August 2023), well before TuxCare began maintaining this version line from 11.0.26 (December 2025). The fix replaced the vulnerable checkSize() method with a safer architecture that validates header sizes after decoding using actual string lengths, eliminating the integer overflow attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53), NVD (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16), cve.org (>= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53), Snyk (>= 9.3.0, < 9.4.53.v20231009; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53.v20231009; >= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16)."
    }
  ]
}