{
  "@id": "urn:uuid:958ebb45-0b59-4485-842d-4b850e8a8545",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty.http2:http2-server. The target Jetty 10.0.32 is NOT AFFECTED by CVE-2022-2048. The vulnerability (synchronous error handling on selector threads causing DoS) was fixed in upstream Jetty 10.0.10 by commit b705091afb9 (May 2022). TuxCare onboarded Jetty at version 10.0.26, which already contained this upstream fix. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "The target Jetty 10.0.32 is NOT AFFECTED by CVE-2022-2048. The vulnerability (synchronous error handling on selector threads causing DoS) was fixed in upstream Jetty 10.0.10 by commit b705091afb9 (May 2022). TuxCare onboarded Jetty at version 10.0.26, which already contained this upstream fix. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty.http2:http2-server. The target Jetty 10.0.32 is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The upstream fix (commit 0f246d12090 by Simone Bordet) shipped in Jetty 10.0.26 and is present in the target. The fix adds rate limiting (128 events/s) for RST_STREAM, CONTINUATION, and SETTINGS frames, plus header block buffer size constraints (maxCapacity). All defenses are active by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target Jetty 10.0.32 is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The upstream fix (commit 0f246d12090 by Simone Bordet) shipped in Jetty 10.0.26 and is present in the target. The fix adds rate limiting (128 events/s) for RST_STREAM, CONTINUATION, and SETTINGS frames, plus header block buffer size constraints (maxCapacity). All defenses are active by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 10.0.32.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 10.0.32.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 10.0.32.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    }
  ]
}