{
  "@id": "urn:uuid:1c42cc85-c69a-4e75-b3c1-695386d3ff92",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.28.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.28.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 11.0.28.tuxcare0004 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 is NOT present in the target. The vulnerability was fixed in upstream Jetty 11.0.10 (June 2022). The target version 11.0.28 already contains the upstream fix (commit b705091a by simone.bordet@gmail.com). Both HTTP/2 and HTTP/3 error handlers correctly return Runnable wrappers instead of calling onBadMessage() directly, preventing selector thread blocking.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 is NOT present in the target. The vulnerability was fixed in upstream Jetty 11.0.10 (June 2022). The target version 11.0.28 already contains the upstream fix (commit b705091a by simone.bordet@gmail.com). Both HTTP/2 and HTTP/3 error handlers correctly return Runnable wrappers instead of calling onBadMessage() directly, preventing selector thread blocking.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.28.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.28.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 11.0.28.tuxcare0004 of org.eclipse.jetty.http2:http2-server. CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in Jetty 11.0.28. The upstream vendor fix (commit 0f246d12090 by simone.bordet@gmail.com, dated 2023-10-09) was already included in the upstream Jetty 11.0.26 release that TuxCare onboarded in December 2025. All defense mechanisms are present and active by default: (1) Rate control on RST_STREAM frames at 128 events/s, (2) Rate control on CONTINUATION, SETTINGS, and PUSH_PROMISE frames, (3) Capacity limits on header block fragment accumulation (maxCapacity checks). The vulnerable pattern does not exist in the target because the upstream fix shipped before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in Jetty 11.0.28. The upstream vendor fix (commit 0f246d12090 by simone.bordet@gmail.com, dated 2023-10-09) was already included in the upstream Jetty 11.0.26 release that TuxCare onboarded in December 2025. All defense mechanisms are present and active by default: (1) Rate control on RST_STREAM frames at 128 events/s, (2) Rate control on CONTINUATION, SETTINGS, and PUSH_PROMISE frames, (3) Capacity limits on header block fragment accumulation (maxCapacity checks). The vulnerable pattern does not exist in the target because the upstream fix shipped before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}