{
  "@id": "urn:uuid:ed549e14-9d25-4918-999a-4ae54c498108",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 affects Jetty versions before 9.4.47, 10.0.10, and 11.0.10. The vulnerability involves invalid HTTP/2 requests causing error responses to be written synchronously on selector threads, which can block and cause denial of service. The target repository is Jetty 10.0.29, which contains the fix from upstream commit b705091afb9 (HTTP/2) and 513a2cb2562 (HTTP/3). Both commits were part of Jetty 10.0.10 release (May 2022) and were already present when TuxCare onboarded version 10.0.26 (December 2025). The code returns error handling as a Runnable (deferred execution) rather than calling onBadMessage() directly, preventing selector thread blocking.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 affects Jetty versions before 9.4.47, 10.0.10, and 11.0.10. The vulnerability involves invalid HTTP/2 requests causing error responses to be written synchronously on selector threads, which can block and cause denial of service. The target repository is Jetty 10.0.29, which contains the fix from upstream commit b705091afb9 (HTTP/2) and 513a2cb2562 (HTTP/3). Both commits were part of Jetty 10.0.10 release (May 2022) and were already present when TuxCare onboarded version 10.0.26 (December 2025). The code returns error handling as a Runnable (deferred execution) rather than calling onBadMessage() directly, preventing selector thread blocking.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty.http2:http2-server. CVE-2023-44487 (HTTP/2 Rapid Reset) is NOT present in this target. The upstream Jetty fix (commit 0f246d12090 by Simone Bordet) was already included in the Jetty 10.0.x release that TuxCare onboarded. The fix adds rate control (128 events/sec) for RST_STREAM, CONTINUATION, and SETTINGS frames, plus bounds checking on header block accumulation. All defenses are present and active by default in the target code at version 10.0.29.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset) is NOT present in this target. The upstream Jetty fix (commit 0f246d12090 by Simone Bordet) was already included in the Jetty 10.0.x release that TuxCare onboarded. The fix adds rate control (128 events/sec) for RST_STREAM, CONTINUATION, and SETTINGS frames, plus bounds checking on header block accumulation. All defenses are present and active by default in the target code at version 10.0.29.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}