{
  "@id": "urn:uuid:861a065d-27e1-44e7-8e85-6b85b905e057",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 11.0.30.tuxcare0002 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 affects Jetty's HTTP/2 error handling, where invalid requests could block selector threads and cause DoS. The fix (deferring error response handling via Runnable) was authored by upstream developer Simone Bordet and shipped in Jetty 11.0.10. Target version 11.0.30 is based on upstream 11.0.26, which already contained the fix. The vulnerable code pattern (synchronous onBadMessage() calls in exception handlers) is not present in HttpChannelOverHTTP2.java or HttpChannelOverHTTP3.java. TuxCare only backported this fix to older 9.4.x versions (9.4.24, 9.4.41) that predated the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 affects Jetty's HTTP/2 error handling, where invalid requests could block selector threads and cause DoS. The fix (deferring error response handling via Runnable) was authored by upstream developer Simone Bordet and shipped in Jetty 11.0.10. Target version 11.0.30 is based on upstream 11.0.26, which already contained the fix. The vulnerable code pattern (synchronous onBadMessage() calls in exception handlers) is not present in HttpChannelOverHTTP2.java or HttpChannelOverHTTP3.java. TuxCare only backported this fix to older 9.4.x versions (9.4.24, 9.4.41) that predated the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 11.0.30.tuxcare0002 of org.eclipse.jetty.http2:http2-server. The target repository (Jetty 11.0.30) is NOT affected by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The upstream fix commit 0f246d12090 by simone.bordet@gmail.com, which adds rate limiting to RST_STREAM, CONTINUATION, SETTINGS, and PUSH_PROMISE frames plus header block capacity limits, shipped in the upstream Jetty release and is present in HEAD. All defensive measures are verified active: rate control on all vulnerable frame types (ResetBodyParser, ContinuationBodyParser, SettingsBodyParser, PushPromiseBodyParser), header block capacity limits in HeaderBlockFragments, and default rate control set to 128 events/s. The fix predates TuxCare's onboarding of version 11.0.26, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target repository (Jetty 11.0.30) is NOT affected by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The upstream fix commit 0f246d12090 by simone.bordet@gmail.com, which adds rate limiting to RST_STREAM, CONTINUATION, SETTINGS, and PUSH_PROMISE frames plus header block capacity limits, shipped in the upstream Jetty release and is present in HEAD. All defensive measures are verified active: rate control on all vulnerable frame types (ResetBodyParser, ContinuationBodyParser, SettingsBodyParser, PushPromiseBodyParser), header block capacity limits in HeaderBlockFragments, and default rate control set to 128 events/s. The fix predates TuxCare's onboarding of version 11.0.26, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}