{
  "@id": "urn:uuid:f63f51b5-e0af-4ea1-8af6-6a8fb85e8048",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T18:11:00.159476+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "action_statement": "Vulnerability CVE-2006-6969 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "action_statement": "Vulnerability CVE-2011-4461 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "action_statement": "Vulnerability CVE-2015-2080 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "action_statement": "Vulnerability CVE-2016-4800 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "action_statement": "Vulnerability CVE-2017-7656 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "action_statement": "Vulnerability CVE-2017-7658 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "action_statement": "Vulnerability CVE-2017-9735 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T18:11:00.159476+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice. not_affected \u2014 CVE-2018-12536 is not present in Jetty 11.0.18. The vulnerability (path disclosure via InvalidPathException in error responses) was fixed in upstream Jetty by commit ad4dceb1c08 in May 2018. This fix was already included in the upstream Jetty 11.0.18 release (October 2023) that TuxCare onboarded. The defense code in ResourceContentFactory.getContent() wraps all exceptions with sanitized Invalid...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 is not present in Jetty 11.0.18. The vulnerability (path disclosure via InvalidPathException in error responses) was fixed in upstream Jetty by commit ad4dceb1c08 in May 2018. This fix was already included in the upstream Jetty 11.0.18 release (October 2023) that TuxCare onboarded. The defense code in ResourceContentFactory.getContent() wraps all exceptions with sanitized Invalid..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "action_statement": "Vulnerability CVE-2018-12545 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T16:12:00.140572+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice. not_affected \u2014 The target repository (Jetty 11.0.18) is NOT affected by CVE-2019-10241. The vulnerability fix was already present in the upstream Jetty release when TuxCare onboarded version 11.0.18. The fix (commit 3d028ab2ca7 from April 2019) was implemented by upstream Jetty maintainer Joakim Erdfelt and shipped in the base release, meaning the vulnerable code pattern (exposing full filesystem paths and un...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.18) is NOT affected by CVE-2019-10241. The vulnerability fix was already present in the upstream Jetty release when TuxCare onboarded version 11.0.18. The fix (commit 3d028ab2ca7 from April 2019) was implemented by upstream Jetty maintainer Joakim Erdfelt and shipped in the base release, meaning the vulnerable code pattern (exposing full filesystem paths and un..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "action_statement": "Vulnerability CVE-2019-10246 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T16:34:00.087449+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice. not_affected \u2014 Target version 11.0.18 is not affected by CVE-2019-10247. The vulnerability involved DefaultHandler's 404 error page disclosing filesystem directory paths via context.toString() output. The upstream fix (commit 04c994712c0) was already included in the jetty-11.0.18 release that TuxCare onboarded. The target's DefaultHandler.java does not contain the vulnerable code pattern - it never calls cont...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 Target version 11.0.18 is not affected by CVE-2019-10247. The vulnerability involved DefaultHandler's 404 error page disclosing filesystem directory paths via context.toString() output. The upstream fix (commit 04c994712c0) was already included in the jetty-11.0.18 release that TuxCare onboarded. The target's DefaultHandler.java does not contain the vulnerable code pattern - it never calls cont..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "action_statement": "Vulnerability CVE-2019-17632 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "action_statement": "Vulnerability CVE-2019-17638 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "action_statement": "Vulnerability CVE-2020-27218 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "action_statement": "Vulnerability CVE-2020-27223 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "action_statement": "Vulnerability CVE-2021-28165 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T15:23:00.070442+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice. not_affected \u2014 Target version 11.0.18 is NOT AFFECTED. CVE-2021-34428 describes a vulnerability where exceptions thrown from SessionListener#sessionDestroyed() prevent session ID invalidation, potentially leaving users logged in. The upstream fix (commit cd6462a6252, May 2021) was already included in the Jetty 11.0.18 release (October 2023) that TuxCare onboarded. The target code at HEAD (1feed477b63) contain...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 Target version 11.0.18 is NOT AFFECTED. CVE-2021-34428 describes a vulnerability where exceptions thrown from SessionListener#sessionDestroyed() prevent session ID invalidation, potentially leaving users logged in. The upstream fix (commit cd6462a6252, May 2021) was already included in the Jetty 11.0.18 release (October 2023) that TuxCare onboarded. The target code at HEAD (1feed477b63) contain..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T14:50:00.140039+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice. not_affected \u2014 The target Jetty 11.0.18 is not affected by CVE-2022-2047. The vulnerability concerns incorrect parsing of URIs with ambiguous authority/path boundaries (e.g., `http://localhost;/path` parsed with host=`localhost;`). The upstream fix (commit d1e64f469362bb9371d530cccded5ecb13fa1cb5) was already present in the Jetty 11.0.18 release that TuxCare onboarded. The fix adds validation to reject combin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 11.0.18 is not affected by CVE-2022-2047. The vulnerability concerns incorrect parsing of URIs with ambiguous authority/path boundaries (e.g., `http://localhost;/path` parsed with host=`localhost;`). The upstream fix (commit d1e64f469362bb9371d530cccded5ecb13fa1cb5) was already present in the Jetty 11.0.18 release that TuxCare onboarded. The fix adds validation to reject combin..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "action_statement": "Vulnerability CVE-2022-2191 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T15:43:00.089646+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice. not_affected \u2014 CVE-2023-26048 affects Jetty multipart request handling, allowing attackers to cause OutOfMemoryError by sending parts with no filename but large content, or many parts. The target Jetty 11.0.18-tuxcare.1 is NOT AFFECTED because the upstream vendor (Webtide) applied the fix in commit a5344d7a260 (Feb 9, 2023) which was included in the upstream Jetty 11.0.18 release before TuxCare onboarded the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26048 affects Jetty multipart request handling, allowing attackers to cause OutOfMemoryError by sending parts with no filename but large content, or many parts. The target Jetty 11.0.18-tuxcare.1 is NOT AFFECTED because the upstream vendor (Webtide) applied the fix in commit a5344d7a260 (Feb 9, 2023) which was included in the upstream Jetty 11.0.18 release before TuxCare onboarded the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T15:12:24.660460+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice. not_affected \u2014 CVE-2023-26049 (cookie smuggling via nonstandard quoted value parsing) is NOT present in Jetty 11.0.18. The upstream fix (commit 7b8c2c1bf08, PR #9339) was already included in the upstream 11.0.18 release that TuxCare onboarded. The fix introduced RFC6265CookieParser which properly rejects cookies with semicolons inside quoted values by marking them invalid and preventing their use in the appli...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via nonstandard quoted value parsing) is NOT present in Jetty 11.0.18. The upstream fix (commit 7b8c2c1bf08, PR #9339) was already included in the upstream 11.0.18 release that TuxCare onboarded. The fix introduced RFC6265CookieParser which properly rejects cookies with semicolons inside quoted values by marking them invalid and preventing their use in the appli..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T15:53:08.555674+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice. not_affected \u2014 CVE-2023-40167 is NOT present in the target. The vulnerability involves Jetty accepting '+' prefix in Content-Length headers, violating RFC 9110. The fix (strict digit-only validation in convertContentLength method) was already present in upstream Jetty 11.0.18 before TuxCare onboarded it. Commit 003e46cae4d7 by Greg Wilkins (2023-08-18) replaced Long.parseLong() with manual character validatio...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-40167 is NOT present in the target. The vulnerability involves Jetty accepting '+' prefix in Content-Length headers, violating RFC 9110. The fix (strict digit-only validation in convertContentLength method) was already present in upstream Jetty 11.0.18 before TuxCare onboarded it. Commit 003e46cae4d7 by Greg Wilkins (2023-08-18) replaced Long.parseLong() with manual character validatio..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "action_statement": "Vulnerability CVE-2024-13009 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:05:44.446026+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "action_statement": "Vulnerability CVE-2024-6763 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:05:44.446026+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "action_statement": "Vulnerability CVE-2024-7708 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:05:44.446026+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 is fixed in version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2024-8184"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:05:44.446026+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      },
      "action_statement": "Vulnerability CVE-2025-11143 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:05:44.446026+00:00",
      "status_notes": "Vulnerability CVE-2026-10050 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2026-10050"
      },
      "action_statement": "Vulnerability CVE-2026-10050 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:05:44.446026+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "action_statement": "Vulnerability CVE-2026-10051 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:05:44.446026+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice. Jetty 11.0.18 is not affected by CVE-2026-1605. The vulnerability exists in Jetty 12.0.30 due to a specific architectural pattern where GzipRequest.destroy() is not called when only request inflation occurs (no response deflation). Jetty 11 uses a fundamentally different architecture: GzipHttpInputInterceptor handles inflation independently, and its lifecycle is managed by the HttpInput recycling mechanism which ensures destroy() is always called when request processing completes, regardless of whether response deflation occurs. The input and output handling are architecturally separate in Jetty 11, eliminating the conditional logic flaw that causes the leak in Jetty 12.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Jetty 11.0.18 is not affected by CVE-2026-1605. The vulnerability exists in Jetty 12.0.30 due to a specific architectural pattern where GzipRequest.destroy() is not called when only request inflation occurs (no response deflation). Jetty 11 uses a fundamentally different architecture: GzipHttpInputInterceptor handles inflation independently, and its lifecycle is managed by the HttpInput recycling mechanism which ensures destroy() is always called when request processing completes, regardless of whether response deflation occurs. The input and output handling are architecturally separate in Jetty 11, eliminating the conditional logic flaw that causes the leak in Jetty 12."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:05:44.446026+00:00",
      "status_notes": "Vulnerability CVE-2026-18659 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2026-18659"
      },
      "action_statement": "Vulnerability CVE-2026-18659 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:05:44.446026+00:00",
      "status_notes": "Vulnerability CVE-2026-18662 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2026-18662"
      },
      "action_statement": "Vulnerability CVE-2026-18662 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:05:44.446026+00:00",
      "status_notes": "Vulnerability CVE-2026-19864 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2026-19864"
      },
      "action_statement": "Vulnerability CVE-2026-19864 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:05:44.446026+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      },
      "action_statement": "Vulnerability CVE-2026-2332 affects version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:05:44.446026+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-httpservice@11.0.18-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:05:44.446026+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 11.0.18-tuxcare.1 of org.eclipse.jetty.osgi:jetty-httpservice. not_affected \u2014 Jetty 11.0.18 is NOT AFFECTED by CVE-2026-8384. The vulnerability is specific to Jetty 12's refactored architecture where URIUtil.canonicalPath() was redesigned to handle encoding, semicolon path parameters, and dot normalization in a single method. Jetty 11 uses a fundamentally different two-method approach: decodePath() strips semicolons first, then canonicalPath() normalizes dots separately....",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.18 is NOT AFFECTED by CVE-2026-8384. The vulnerability is specific to Jetty 12's refactored architecture where URIUtil.canonicalPath() was redesigned to handle encoding, semicolon path parameters, and dot normalization in a single method. Jetty 11 uses a fundamentally different two-method approach: decodePath() strips semicolons first, then canonicalPath() normalizes dots separately...."
    }
  ]
}