{
  "@id": "urn:uuid:e29b72f0-70da-4444-9573-d659d9a0dd01",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 20,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:12:34.459172+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.48.v20220622-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.48.v20220622-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 is not present in Jetty 9.4.48.v20220622. The vulnerability involved synchronous error handling on HTTP/2 selector threads that could cause denial of service when malicious clients sent invalid requests. The upstream fix (commit be912d4315839405a8ae601f2e4ee0306867266e) was already included in Jetty 9.4.48 when TuxCare onboarded this version. The target code at jetty-http2/http2-server/src/main/java/org/eclipse/jetty/http2/server/HttpChannelOverHTTP2.java (lines 148, 152, 178, 182) returns error handling as Runnables (lambda expressions: `() -> onBadMessage(x)`), deferring execution from selector threads and preventing the blocking condition that enabled the DoS attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 is not present in Jetty 9.4.48.v20220622. The vulnerability involved synchronous error handling on HTTP/2 selector threads that could cause denial of service when malicious clients sent invalid requests. The upstream fix (commit be912d4315839405a8ae601f2e4ee0306867266e) was already included in Jetty 9.4.48 when TuxCare onboarded this version. The target code at jetty-http2/http2-server/src/main/java/org/eclipse/jetty/http2/server/HttpChannelOverHTTP2.java (lines 148, 152, 178, 182) returns error handling as Runnables (lambda expressions: `() -> onBadMessage(x)`), deferring execution from selector threads and preventing the blocking condition that enabled the DoS attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.48.v20220622-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.48.v20220622-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.http2:http2-server, and is fixed in 9.4.48.v20220622-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "action_statement": "Vulnerability CVE-2023-44487 affects version 9.4.48.v20220622-tuxcare.2 of org.eclipse.jetty.http2:http2-server, and is fixed in 9.4.48.v20220622-tuxcare.3."
    }
  ]
}