{
  "@id": "urn:uuid:2a45d2c1-8e2b-427a-bcad-25623b38e518",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:05:28.850476+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T17:56:17.260017+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 CVE-2021-28163 is not present in the target. The vulnerability concerns symlinked webapps directories being deployed as static web applications, exposing directory contents for download. The upstream fix (commit ebe8311333d by Greg Wilkins, 2021-03-24) that prevents this by detecting symlinks using Files.isSameFile() was already present in Jetty 9.4.58.1, which TuxCare onboarded on 2025-12-12. ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28163 is not present in the target. The vulnerability concerns symlinked webapps directories being deployed as static web applications, exposing directory contents for download. The upstream fix (commit ebe8311333d by Greg Wilkins, 2021-03-24) that prevents this by detecting symlinks using Files.isSameFile() was already present in Jetty 9.4.58.1, which TuxCare onboarded on 2025-12-12. ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:01:01.522418+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:01:01.522418+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:35:44.733301+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:35:44.733301+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:35:44.733301+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    }
  ]
}