{
  "@id": "urn:uuid:98e4f989-4d54-494d-b43b-b101afdef690",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T20:14:12.696742+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.51.v20230217-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.51.v20230217-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:14:01.937801+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 9.4.51.v20230217-tuxcare.2 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 is NOT present in the target. The vulnerability was fixed in upstream Jetty 9.4.47 (released June 2022) by commit be912d43158, which was authored by upstream developer Joakim Erdfelt. The target version 9.4.51.v20230217 (released February 2023) includes this fix as part of the upstream release. The fix changes error handling in HTTP/2 request processing to return error handling as a Runnable instead of executing it synchronously on the selector thread, preventing selector thread blocking that could cause denial of service.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 is NOT present in the target. The vulnerability was fixed in upstream Jetty 9.4.47 (released June 2022) by commit be912d43158, which was authored by upstream developer Joakim Erdfelt. The target version 9.4.51.v20230217 (released February 2023) includes this fix as part of the upstream release. The fix changes error handling in HTTP/2 request processing to return error handling as a Runnable instead of executing it synchronously on the selector thread, preventing selector thread blocking that could cause denial of service.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.51.v20230217-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.51.v20230217-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:14:12.696742+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 9.4.51.v20230217-tuxcare.2 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      }
    }
  ]
}