{
  "@id": "urn:uuid:84458929-8e9a-4264-ba15-dfa24b7a41ef",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 27,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:50:59.216609+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.26-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.26-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T17:50:59.216609+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 11.0.26-tuxcare.3 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 CVE-2021-28163 is NOT present in this target. The vulnerability allowed symlinked webapps directories to be deployed as static web applications, exposing directory contents. The fix was already present in upstream Jetty 11.0.26 before TuxCare onboarded the version. The target code correctly uses resource.isSame() with Files.isSameFile() to detect when a scanned file represents the same filesyst...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28163 is NOT present in this target. The vulnerability allowed symlinked webapps directories to be deployed as static web applications, exposing directory contents. The fix was already present in upstream Jetty 11.0.26 before TuxCare onboarded the version. The target code correctly uses resource.isSame() with Files.isSameFile() to detect when a scanned file represents the same filesyst..."
    }
  ]
}