{
  "@id": "urn:uuid:28b88390-3a0f-425d-b824-1d8790584b86",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:02:00.202619+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.59.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.59.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 is NOT present in target version 9.4.59.tuxcare0003. The upstream fix (commit be912d43158 by Joakim Erdfelt) was already included in the upstream Jetty release that TuxCare onboarded. The vulnerable pattern (synchronous error handling that blocks selector threads) has been replaced with deferred execution via Runnable returns in both HttpChannelOverHTTP2.onRequest() and onPushRequest() methods. This is an upstream fix that predates TuxCare's work on this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 is NOT present in target version 9.4.59.tuxcare0003. The upstream fix (commit be912d43158 by Joakim Erdfelt) was already included in the upstream Jetty release that TuxCare onboarded. The vulnerable pattern (synchronous error handling that blocks selector threads) has been replaced with deferred execution via Runnable returns in both HttpChannelOverHTTP2.onRequest() and onPushRequest() methods. This is an upstream fix that predates TuxCare's work on this version branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.59.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.59.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty.http2:http2-server. CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT affecting this target. The vulnerability requires rate limiting on HTTP/2 control frames (RST_STREAM, CONTINUATION, SETTINGS) and bounds on header block accumulation to prevent resource exhaustion. All required protections were implemented in upstream Jetty 9.4.53.v20231009 (commit 0f246d12090 by Simone Bordet, October 2023). The target version 9.4.59.tuxcare0003 includes this upstream fix, which was already present in the release that TuxCare onboarded. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT affecting this target. The vulnerability requires rate limiting on HTTP/2 control frames (RST_STREAM, CONTINUATION, SETTINGS) and bounds on header block accumulation to prevent resource exhaustion. All required protections were implemented in upstream Jetty 9.4.53.v20231009 (commit 0f246d12090 by Simone Bordet, October 2023). The target version 9.4.59.tuxcare0003 includes this upstream fix, which was already present in the release that TuxCare onboarded. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}