{
  "@id": "urn:uuid:69744a3f-8541-4969-a6a4-2ee592556db8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:29:48.390816+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 affects Jetty's HTTP/2 error handling, where invalid requests could block selector threads and cause denial of service. The fix was already present in upstream Jetty 11.0.26 (released May 2022) before TuxCare onboarded the project. The target repository (Jetty 11.0.34.tuxcare0001) contains the complete fix in both HTTP/2 and HTTP/3 implementations. All error-handling code in catch blocks now returns Runnable lambdas for deferred execution instead of executing synchronously on selector threads.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 affects Jetty's HTTP/2 error handling, where invalid requests could block selector threads and cause denial of service. The fix was already present in upstream Jetty 11.0.26 (released May 2022) before TuxCare onboarded the project. The target repository (Jetty 11.0.34.tuxcare0001) contains the complete fix in both HTTP/2 and HTTP/3 implementations. All error-handling code in catch blocks now returns Runnable lambdas for deferred execution instead of executing synchronously on selector threads.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty.http2:http2-server. Target repository Jetty 11.0.34.tuxcare0001 is NOT affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The vulnerability was fixed in upstream commit 0f246d12090fb15b7b21dee8429f459fd792de53 by Simone Bordet (simone.bordet@gmail.com), included in Jetty 9.4.53.v20231009 (October 2023). This fix was already present in the upstream release that TuxCare onboarded. All HTTP/2 parsers (ResetBodyParser, SettingsBodyParser, ContinuationBodyParser, PushPromiseBodyParser) implement rate control via rateControlOnEvent(), enforcing a 128 events/second limit through WindowRateControl sliding window mechanism. HeaderBlockFragments includes maxCapacity bounds checking to prevent unbounded buffer growth. The vulnerable pattern (unlimited HTTP/2 control frame processing) has been eliminated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "Target repository Jetty 11.0.34.tuxcare0001 is NOT affected by CVE-2023-44487 (HTTP/2 Rapid Reset). The vulnerability was fixed in upstream commit 0f246d12090fb15b7b21dee8429f459fd792de53 by Simone Bordet (simone.bordet@gmail.com), included in Jetty 9.4.53.v20231009 (October 2023). This fix was already present in the upstream release that TuxCare onboarded. All HTTP/2 parsers (ResetBodyParser, SettingsBodyParser, ContinuationBodyParser, PushPromiseBodyParser) implement rate control via rateControlOnEvent(), enforcing a 128 events/second limit through WindowRateControl sliding window mechanism. HeaderBlockFragments includes maxCapacity bounds checking to prevent unbounded buffer growth. The vulnerable pattern (unlimited HTTP/2 control frame processing) has been eliminated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:05:00.113792+00:00",
      "status_notes": "Vulnerability CVE-2026-95533 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-95533"
      }
    }
  ]
}