{
  "@id": "urn:uuid:ee69f2c4-9ed1-4a1a-8738-731787c5ccb5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 22,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.26-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.26-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 10.0.26-tuxcare.3 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 affects Jetty versions before 9.4.47, 10.0.10, and 11.0.10. The target repository is Jetty 10.0.26-tuxcare.3, which already contains the upstream fix. The vulnerability pattern (synchronous error handling that blocks selector threads) is not present because the fix was shipped in the upstream release 10.0.10 and is therefore present in 10.0.26. The fix changes exception handlers to return error-handling logic as a Runnable (deferred execution) instead of calling onBadMessage() directly on the selector thread, preventing denial of service through thread exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 affects Jetty versions before 9.4.47, 10.0.10, and 11.0.10. The target repository is Jetty 10.0.26-tuxcare.3, which already contains the upstream fix. The vulnerability pattern (synchronous error handling that blocks selector threads) is not present because the fix was shipped in the upstream release 10.0.10 and is therefore present in 10.0.26. The fix changes exception handlers to return error-handling logic as a Runnable (deferred execution) instead of calling onBadMessage() directly on the selector thread, preventing denial of service through thread exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.26-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.26-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.0.26-tuxcare.3 of org.eclipse.jetty.http2:http2-server. CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in this target. The vulnerability was fixed by upstream commit 0f246d12090fb15b7b21dee8429f459fd792de53 (authored by Simone Bordet) which was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded. The target contains all rate control defenses from the upstream fix: rate limiting on RST_STREAM, CONTINUATION, SETTINGS, and PUSH_PROMISE frames, plus header block accumulation caps. Verdict: not_affected with upstream fix attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in this target. The vulnerability was fixed by upstream commit 0f246d12090fb15b7b21dee8429f459fd792de53 (authored by Simone Bordet) which was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded. The target contains all rate control defenses from the upstream fix: rate limiting on RST_STREAM, CONTINUATION, SETTINGS, and PUSH_PROMISE frames, plus header block accumulation caps. Verdict: not_affected with upstream fix attribution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}