{
  "@id": "urn:uuid:d6cad393-d3e1-4882-9c34-515e79e85765",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.http2:http2-server. CVE-2022-2048 affects Jetty's HTTP/2 error handling where invalid requests could block selector threads, causing DoS. The vulnerability was fixed in upstream Jetty 9.4.47 (May 2022) by deferring error response writing via Runnable return. The target version 9.4.63.tuxcare0001 includes this upstream fix (commit be912d43158 by Joakim Erdfelt), which predates TuxCare's onboarding of version 9.4.58.1. The vulnerable pattern (synchronous onBadMessage() calls returning null) is not present; all exception handlers properly return Runnables for deferred execution. Verdict: not_affected because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "CVE-2022-2048 affects Jetty's HTTP/2 error handling where invalid requests could block selector threads, causing DoS. The vulnerability was fixed in upstream Jetty 9.4.47 (May 2022) by deferring error response writing via Runnable return. The target version 9.4.63.tuxcare0001 includes this upstream fix (commit be912d43158 by Joakim Erdfelt), which predates TuxCare's onboarding of version 9.4.58.1. The vulnerable pattern (synchronous onBadMessage() calls returning null) is not present; all exception handlers properly return Runnables for deferred execution. Verdict: not_affected because the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.http2:http2-server. Target Jetty 9.4.63 is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The upstream fix (commit 0f246d12090fb15b7b21dee8429f459fd792de53 by Simone Bordet, Oct 2023) was already present in the upstream release before TuxCare onboarded this version. All defense mechanisms are active: rate control on RST_STREAM, CONTINUATION, SETTINGS, and invalid PUSH_PROMISE frames; header block capacity limits; and increased rate threshold to 128 events/second. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "Target Jetty 9.4.63 is not affected by CVE-2023-44487 (HTTP/2 Rapid Reset attack). The upstream fix (commit 0f246d12090fb15b7b21dee8429f459fd792de53 by Simone Bordet, Oct 2023) was already present in the upstream release before TuxCare onboarded this version. All defense mechanisms are active: rate control on RST_STREAM, CONTINUATION, SETTINGS, and invalid PUSH_PROMISE frames; header block capacity limits; and increased rate threshold to 128 events/second. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    }
  ]
}