{
  "@id": "urn:uuid:898aa96e-1846-4f55-bf4c-de65fc1f71c9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2022-2048 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty.http2:http2-server. Target version 9.4.64 is not affected by CVE-2022-2048. The vulnerability (HTTP/2 selector threads blocking on synchronous error response writes to slow clients) is not present in the target code. The fix was already included in upstream Jetty release 9.4.47 (commit be912d4315839405a8ae601f2e4ee0306867266e by joakim.erdfelt@gmail.com) before TuxCare onboarded this version lineage at 9.4.58.1. The target code correctly returns error handling as Runnable lambdas for deferred execution, preventing selector thread blocking.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2048"
      },
      "impact_statement": "Target version 9.4.64 is not affected by CVE-2022-2048. The vulnerability (HTTP/2 selector threads blocking on synchronous error response writes to slow clients) is not present in the target code. The fix was already included in upstream Jetty release 9.4.47 (commit be912d4315839405a8ae601f2e4ee0306867266e by joakim.erdfelt@gmail.com) before TuxCare onboarded this version lineage at 9.4.58.1. The target code correctly returns error handling as Runnable lambdas for deferred execution, preventing selector thread blocking.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.47; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (< 9.4.47; >= 10.0.0, < 10.0.9; >= 11.0.0, < 11.0.9), Snyk (< 9.4.47; >= 10.0.0-alpha0, < 10.0.10; >= 11.0.0-alpha0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty.http2:http2-server. CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in Jetty 9.4.64. The upstream fix commit 0f246d12090 \"Fixes #10679 - Review HTTP/2 rate control\" by Simone Bordet (Oct 9, 2023) is present in HEAD and was included in the upstream release before TuxCare onboarded this version. The fix adds comprehensive rate limiting to HTTP/2 frame processing (RST_STREAM, CONTINUATION, SETTINGS, invalid frames) and caps header block fragment accumulation to prevent resource exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "impact_statement": "CVE-2023-44487 (HTTP/2 Rapid Reset attack) is NOT present in Jetty 9.4.64. The upstream fix commit 0f246d12090 \"Fixes #10679 - Review HTTP/2 rate control\" by Simone Bordet (Oct 9, 2023) is present in HEAD and was included in the upstream release before TuxCare onboarded this version. The fix adds comprehensive rate limiting to HTTP/2 frame processing (RST_STREAM, CONTINUATION, SETTINGS, invalid frames) and caps header block fragment accumulation to prevent resource exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 9.3.0, < 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17), NVD (< 9.4.53; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17; >= 12.0.0, < 12.0.2), Snyk (< 9.4.53.v20231009; >= 10.0.0, < 10.0.17; >= 11.0.0, < 11.0.17)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 9.4.64.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 9.4.64.tuxcare0001 of org.eclipse.jetty.http2:http2-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    }
  ]
}