{
  "@id": "urn:uuid:2b7e7115-3558-47b9-a123-4ea899e40de8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.27.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.27.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 11.0.27.tuxcare0002 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 is NOT present in this Jetty 11.0.27.tuxcare0005 target. The vulnerability involved selector thread blocking when writing error responses for invalid HTTP/2 requests. The upstream fix (commits b705091afb9 for HTTP/2 and 513a2cb2562 for HTTP/3) was already included in the upstream Jetty release that TuxCare onboarded (11.0.26), predating all TuxCare backport activity. Both HttpChannelOverHTTP2.java and HttpChannelOverHTTP3.java contain the patched code that returns error handling as a Runnable instead of executing it synchronously on the selector thread.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 is NOT present in this Jetty 11.0.27.tuxcare0005 target. The vulnerability involved selector thread blocking when writing error responses for invalid HTTP/2 requests. The upstream fix (commits b705091afb9 for HTTP/2 and 513a2cb2562 for HTTP/3) was already included in the upstream Jetty release that TuxCare onboarded (11.0.26), predating all TuxCare backport activity. Both HttpChannelOverHTTP2.java and HttpChannelOverHTTP3.java contain the patched code that returns error handling as a Runnable instead of executing it synchronously on the selector thread.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.27.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.27.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 11.0.27.tuxcare0002 of org.eclipse.jetty.http2:http2-server. The target repository (Jetty 11.0.27) is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The upstream fix commit 0f246d12090 by Simone Bordet was shipped in Jetty 11.0.26 (October 2023) and is present in the target version. All defense mechanisms are verified in the source code: rate limiting for RST_STREAM, SETTINGS, and CONTINUATION frames using sliding window counters (128 events/s threshold), and max capacity checks for header block buffer growth. The vulnerable code patterns allowing unbounded rapid resets are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (Jetty 11.0.27) is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The upstream fix commit 0f246d12090 by Simone Bordet was shipped in Jetty 11.0.26 (October 2023) and is present in the target version. All defense mechanisms are verified in the source code: rate limiting for RST_STREAM, SETTINGS, and CONTINUATION frames using sliding window counters (128 events/s threshold), and max capacity checks for header block buffer growth. The vulnerable code patterns allowing unbounded rapid resets are not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}