{
  "@id": "urn:uuid:c968f98c-ec95-4718-8ad9-5d9eaa9d9f90",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.28.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.28.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 10.0.28.tuxcare0003 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048: Target version 10.0.28 is NOT AFFECTED. The vulnerability (DoS via blocking error responses on HTTP/2 selector threads) is not present because the upstream vendor's fix was already included in the upstream Jetty release that TuxCare onboarded. The fix (commit be912d43158 by joakim.erdfelt@gmail.com) wraps error-handling calls in Runnables for deferred execution, preventing selector thread blocking. This fix shipped in upstream Jetty before TuxCare's first commit (cf975b23e1f \"setup 10.0.26\"), making it an upstream-provided protection rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048: Target version 10.0.28 is NOT AFFECTED. The vulnerability (DoS via blocking error responses on HTTP/2 selector threads) is not present because the upstream vendor's fix was already included in the upstream Jetty release that TuxCare onboarded. The fix (commit be912d43158 by joakim.erdfelt@gmail.com) wraps error-handling calls in Runnables for deferred execution, preventing selector thread blocking. This fix shipped in upstream Jetty before TuxCare's first commit (cf975b23e1f \"setup 10.0.26\"), making it an upstream-provided protection rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.28.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.28.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.0.28.tuxcare0003 of org.eclipse.jetty.http2:http2-server. Target Jetty 10.0.28 is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset). All defenses from the upstream vendor patch are already present in the target code: (1) rate control on RST_STREAM, CONTINUATION, SETTINGS, and invalid PUSH_PROMISE/HEADERS frames via rateControlOnEvent() checks; (2) HeaderBlockFragments buffer capacity limits preventing unbounded memory growth; (3) default rate control factory set to 128 events/second. The fix commit dbb94514dc9 by Simone Bordet was shipped in upstream Jetty 10.0.17 (October 2023), well before TuxCare onboarded version 10.0.26 (December 2025). The vulnerability pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "Target Jetty 10.0.28 is NOT AFFECTED by CVE-2023-44487 (HTTP/2 Rapid Reset). All defenses from the upstream vendor patch are already present in the target code: (1) rate control on RST_STREAM, CONTINUATION, SETTINGS, and invalid PUSH_PROMISE/HEADERS frames via rateControlOnEvent() checks; (2) HeaderBlockFragments buffer capacity limits preventing unbounded memory growth; (3) default rate control factory set to 128 events/second. The fix commit dbb94514dc9 by Simone Bordet was shipped in upstream Jetty 10.0.17 (October 2023), well before TuxCare onboarded version 10.0.26 (December 2025). The vulnerability pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}