{
  "@id": "urn:uuid:38d6788c-ec2f-48d9-b4ea-2b2c54bb1f29",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.53.v20231009-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.53.v20231009-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T14:17:18.008233+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 9.4.53.v20231009-tuxcare.9 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 describes a denial-of-service vulnerability where invalid HTTP/2 requests cause blocking error responses to be written directly from selector threads, potentially exhausting all selector threads. The upstream fix (commit be912d4315839405a8ae601f2e4ee0306867266e by Joakim Erdfelt) was already included in Jetty 9.4.53.v20231009 before TuxCare onboarded it (first TuxCare commit 00ea9c6d008). The target is not affected because the vulnerable pattern is not present - all error handling in HttpChannelOverHTTP2 returns Runnable for asynchronous execution instead of blocking selector threads.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 describes a denial-of-service vulnerability where invalid HTTP/2 requests cause blocking error responses to be written directly from selector threads, potentially exhausting all selector threads. The upstream fix (commit be912d4315839405a8ae601f2e4ee0306867266e by Joakim Erdfelt) was already included in Jetty 9.4.53.v20231009 before TuxCare onboarded it (first TuxCare commit 00ea9c6d008). The target is not affected because the vulnerable pattern is not present - all error handling in HttpChannelOverHTTP2 returns Runnable for asynchronous execution instead of blocking selector threads.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.53.v20231009-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.53.v20231009-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T14:17:18.008233+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.53.v20231009-tuxcare.9 of org.eclipse.jetty.http2:http2-server. already_fixed \u2014 The target repository (Jetty 9.4.53.v20231009-tuxcare.5 at commit 410a3b078eb) already contains the complete fix for CVE-2023-44487 (HTTP/2 Rapid Reset). The fix from upstream commit 0f246d12090 'Fixes #10679 - Review HTTP/2 rate control' is present and active by default. Rate limiting is enforced on RST_STREAM, CONTINUATION, SETTINGS, and other HTTP/2 control frames at 128 events/second, preve...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "already_fixed \u2014 The target repository (Jetty 9.4.53.v20231009-tuxcare.5 at commit 410a3b078eb) already contains the complete fix for CVE-2023-44487 (HTTP/2 Rapid Reset). The fix from upstream commit 0f246d12090 'Fixes #10679 - Review HTTP/2 rate control' is present and active by default. Rate limiting is enforced on RST_STREAM, CONTINUATION, SETTINGS, and other HTTP/2 control frames at 128 events/second, preve..."
    }
  ]
}