{
  "@id": "urn:uuid:39a81b9c-9810-4c8b-99b1-5c982f04eab8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 25,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.19-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.19-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 11.0.19-tuxcare.4 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 is NOT present in target Jetty 11.0.19. The vulnerability was fixed by upstream Jetty maintainer Simone Bordet in commits b705091afb9 (HTTP/2) and 513a2cb2562 (HTTP/3), which are ancestors of HEAD and were part of the upstream release 11.0.19 before TuxCare onboarded this version. The fix changes error handling in onRequest() and onPushRequest() methods to return lambda expressions (() -> onBadMessage(x)) instead of calling onBadMessage(x) directly, preventing selector thread blocking during error response writes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 is NOT present in target Jetty 11.0.19. The vulnerability was fixed by upstream Jetty maintainer Simone Bordet in commits b705091afb9 (HTTP/2) and 513a2cb2562 (HTTP/3), which are ancestors of HEAD and were part of the upstream release 11.0.19 before TuxCare onboarded this version. The fix changes error handling in onRequest() and onPushRequest() methods to return lambda expressions (() -> onBadMessage(x)) instead of calling onBadMessage(x) directly, preventing selector thread blocking during error response writes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.19-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.19-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:01:00.133094+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 11.0.19-tuxcare.4 of org.eclipse.jetty.http2:http2-server. CVE-2023-44487 (HTTP/2 Rapid Reset) fix is already present in target version 11.0.19. The WindowRateControl mechanism with sliding window rate limiting (default 128 resets/second) was introduced in upstream Jetty commit cfe1baa048296e90f95773db680ca4d5ef24e0a2 (2019-08-17) and shipped with the upstream 11.0.19 release. The target code contains the complete mitigation: ResetBodyParser enforces rate limits on RST_STREAM frames and terminates connections exceeding the threshold with ENHANCE_YOUR_CALM_ERROR.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset) fix is already present in target version 11.0.19. The WindowRateControl mechanism with sliding window rate limiting (default 128 resets/second) was introduced in upstream Jetty commit cfe1baa048296e90f95773db680ca4d5ef24e0a2 (2019-08-17) and shipped with the upstream 11.0.19 release. The target code contains the complete mitigation: ResetBodyParser enforces rate limits on RST_STREAM frames and terminates connections exceeding the threshold with ENHANCE_YOUR_CALM_ERROR.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}