{
  "@id": "urn:uuid:b3d24064-a1e6-47c5-84f0-9f144b1f058e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:05:28.850476+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 is NOT present in the target. The vulnerability involved HTTP/2 error handling that directly called onBadMessage() from the selector thread, causing blocking writes when flow control was exhausted. The upstream fix (commit b705091afb9 by Simone Bordet) changed error handling to return a Runnable for async execution, preventing selector thread blocking. This fix was already present in upstream version 11.0.26 before TuxCare onboarded the project, and is present in the target at version 11.0.33. Both HTTP/2 (HttpChannelOverHTTP2.java lines 161, 165, 191, 195) and HTTP/3 (HttpChannelOverHTTP3.java lines 160, 164) components have the fix applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 is NOT present in the target. The vulnerability involved HTTP/2 error handling that directly called onBadMessage() from the selector thread, causing blocking writes when flow control was exhausted. The upstream fix (commit b705091afb9 by Simone Bordet) changed error handling to return a Runnable for async execution, preventing selector thread blocking. This fix was already present in upstream version 11.0.26 before TuxCare onboarded the project, and is present in the target at version 11.0.33. Both HTTP/2 (HttpChannelOverHTTP2.java lines 161, 165, 191, 195) and HTTP/3 (HttpChannelOverHTTP3.java lines 160, 164) components have the fix applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 11.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server. The target Jetty 11.0.33 is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The comprehensive fix (rate-limiting RST_STREAM, SETTINGS, CONTINUATION frames at 128 events/second) was already present in upstream Jetty 11.0.26 when TuxCare onboarded that version. All critical defense components are present and enabled by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "The target Jetty 11.0.33 is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The comprehensive fix (rate-limiting RST_STREAM, SETTINGS, CONTINUATION frames at 128 events/second) was already present in upstream Jetty 11.0.26 when TuxCare onboarded that version. All critical defense components are present and enabled by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T01:37:47.366906+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 11.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T01:37:47.366906+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 11.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T01:37:47.366906+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 11.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T02:29:34.635822+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 11.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T02:29:34.635822+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 11.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.33.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-25T02:29:34.635822+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 11.0.33.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    }
  ]
}