{
  "@id": "urn:uuid:898c1b0e-2ae2-4579-bec7-f74fe33770f2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T15:49:43.700401+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-client@11.0.28.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-client@11.0.28.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-10-31T14:49:00.142928+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 11.0.28.tuxcare0004 of org.eclipse.jetty:jetty-client. not_affected \u2014 CVE-2022-2047 affects Jetty's HttpURI class parsing of URIs with semicolons in ambiguous positions (e.g., http://localhost;/path). The vulnerability was fixed in Jetty 11.0.10 by upstream commit d1e64f469362bb9371d530cccded5ecb13fa1cb5 (authored by Simone Bordet). The target repository is version 11.0.28.tuxcare0005, onboarded by TuxCare from upstream version 11.0.26, which already contained th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2047 affects Jetty's HttpURI class parsing of URIs with semicolons in ambiguous positions (e.g., http://localhost;/path). The vulnerability was fixed in Jetty 11.0.10 by upstream commit d1e64f469362bb9371d530cccded5ecb13fa1cb5 (authored by Simone Bordet). The target repository is version 11.0.28.tuxcare0005, onboarded by TuxCare from upstream version 11.0.26, which already contained th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-client@11.0.28.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-client@11.0.28.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-10-31T15:49:43.700401+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 does not affect version 11.0.28.tuxcare0004 of org.eclipse.jetty:jetty-client. not_affected \u2014 CVE-2023-40167: Target is NOT AFFECTED. The vulnerability (accepting '+' prefix in Content-Length header values) was fixed in upstream Jetty commit e4d596eafc8 by Joakim Erdfelt, which was already included in Jetty 11.0.26. TuxCare onboarded version 11.0.26 with this fix already present. The target's convertContentLength() method (lines 1114-1131 in HttpParser.java) correctly validates each cha...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-40167: Target is NOT AFFECTED. The vulnerability (accepting '+' prefix in Content-Length header values) was fixed in upstream Jetty commit e4d596eafc8 by Joakim Erdfelt, which was already included in Jetty 11.0.26. TuxCare onboarded version 11.0.26 with this fix already present. The target's convertContentLength() method (lines 1114-1131 in HttpParser.java) correctly validates each cha..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-client@11.0.28.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-client@11.0.28.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 does not affect version 11.0.28.tuxcare0004 of org.eclipse.jetty:jetty-client. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "impact_statement": "fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-client@11.0.28.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-client@11.0.28.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 is fixed in version 11.0.28.tuxcare0004 of org.eclipse.jetty:jetty-client.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-client@11.0.28.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-client@11.0.28.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 is fixed in version 11.0.28.tuxcare0004 of org.eclipse.jetty:jetty-client.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      }
    }
  ]
}