{
  "@id": "urn:uuid:8efbba00-7244-4c6f-8338-2a161aa5ccfa",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.61.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.61.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 9.4.61.tuxcare0001 of org.eclipse.jetty.http2:http2-server. Target version 9.4.61 is not affected by CVE-2022-2048. The vulnerability (synchronous error response writing from selector thread causing DoS) was fixed in upstream Jetty 9.4.47 (May 2022) by commit be912d43158. The fix changed exception handling in HttpChannelOverHTTP2 to return error handling as a Runnable for deferred execution instead of calling onBadMessage() synchronously. Target version 9.4.61 inherited this fix from the upstream release, which TuxCare onboarded. All four exception handlers (onRequest and onPushRequest, both BadMessageException and Throwable catches) correctly return `() -> onBadMessage(x)` instead of the vulnerable `onBadMessage(x); return null;` pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "Target version 9.4.61 is not affected by CVE-2022-2048. The vulnerability (synchronous error response writing from selector thread causing DoS) was fixed in upstream Jetty 9.4.47 (May 2022) by commit be912d43158. The fix changed exception handling in HttpChannelOverHTTP2 to return error handling as a Runnable for deferred execution instead of calling onBadMessage() synchronously. Target version 9.4.61 inherited this fix from the upstream release, which TuxCare onboarded. All four exception handlers (onRequest and onPushRequest, both BadMessageException and Throwable catches) correctly return `() -> onBadMessage(x)` instead of the vulnerable `onBadMessage(x); return null;` pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.61.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.61.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.61.tuxcare0001 of org.eclipse.jetty.http2:http2-server. CVE-2023-44487 (HTTP/2 Rapid Reset) is NOT present in Jetty 9.4.61. The upstream fix (commit 0f246d12090fb15b7b21dee8429f459fd792de53) was included in Jetty 9.4.53.v20231009 and is therefore present in version 9.4.61. The fix adds rate control (128 events/second) to RST_STREAM, CONTINUATION, SETTINGS, and other HTTP/2 frames, plus buffer size limits on header accumulation. All defenses are active by default in the target code. This is an upstream fix authored by simone.bordet@gmail.com that shipped in the upstream release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset) is NOT present in Jetty 9.4.61. The upstream fix (commit 0f246d12090fb15b7b21dee8429f459fd792de53) was included in Jetty 9.4.53.v20231009 and is therefore present in version 9.4.61. The fix adds rate control (128 events/second) to RST_STREAM, CONTINUATION, SETTINGS, and other HTTP/2 frames, plus buffer size limits on header accumulation. All defenses are active by default in the target code. This is an upstream fix authored by simone.bordet@gmail.com that shipped in the upstream release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}