{
  "@id": "urn:uuid:695f6a50-266a-4d9f-ad78-20ce2ff4a1fd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T00:56:31.713844+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 describes predictable session IDs generated using java.util.Random in old Jetty versions (before 4.2.27, 5.1.12, 6.0.2, 6.1.0pre3). The target version 10.0.26 uses java.security.SecureRandom for session ID generation by default. The vulnerable pattern is not present; the fix was already shipped in the upstream release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 describes predictable session IDs generated using java.util.Random in old Jetty versions (before 4.2.27, 5.1.12, 6.0.2, 6.1.0pre3). The target version 10.0.26 uses java.security.SecureRandom for session ID generation by default. The vulnerable pattern is not present; the fix was already shipped in the upstream release that TuxCare onboarded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty 10.0.26 is NOT AFFECTED by CVE-2011-4461. The vulnerability involved unbounded form parameter processing allowing hash collision DOS attacks. The upstream fix (commit 085c79d7d6c by Greg Wilkins) added a configurable maxFormKeys limit (default 1000) that prevents the attack by stopping parameter parsing when the limit is exceeded. This fix was already present in the upstream Jetty ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 10.0.26 is NOT AFFECTED by CVE-2011-4461. The vulnerability involved unbounded form parameter processing allowing hash collision DOS attacks. The upstream fix (commit 085c79d7d6c by Greg Wilkins) added a configurable maxFormKeys limit (default 1000) that prevents the attack by stopping parameter parsing when the limit is exceeded. This fix was already present in the upstream Jetty ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.26 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.26 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Jetty 9.3.x before 9.3.9 on Windows, allowing path traversal via escaped backslashes. The target (Jetty 10.0.26) contains the upstream fix from commit 97af3d663fd (May 2016) which was already present in the upstream release when TuxCare onboarded version 10.0.26. The fix implements a defense mechanism in PathResource.checkAliasPath() that detects when Windows filesystem no...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Jetty 9.3.x before 9.3.9 on Windows, allowing path traversal via escaped backslashes. The target (Jetty 10.0.26) contains the upstream fix from commit 97af3d663fd (May 2016) which was already present in the upstream release when TuxCare onboarded version 10.0.26. The fix implements a defense mechanism in PathResource.checkAliasPath() that detects when Windows filesystem no..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. CVE-2017-7656 affects Jetty 9.2.x and older, 9.3.x, and 9.4.x with non-default RFC2616 compliance. Target version 10.0.26 is unaffected because the upstream fix (commit a285deea42f by gregw@webtide.com, dated 2018-05-17) was already included in the upstream release before TuxCare onboarded it. The fix adds protections against multiple Content-Length headers, Content-Length + Transfer-Encoding: chunked conflicts, and chunk length overflow. Default RFC7230 compliance mode rejects these violations, preventing HTTP request smuggling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "CVE-2017-7656 affects Jetty 9.2.x and older, 9.3.x, and 9.4.x with non-default RFC2616 compliance. Target version 10.0.26 is unaffected because the upstream fix (commit a285deea42f by gregw@webtide.com, dated 2018-05-17) was already included in the upstream release before TuxCare onboarded it. The fix adds protections against multiple Content-Length headers, Content-Length + Transfer-Encoding: chunked conflicts, and chunk length overflow. Default RFC7230 compliance mode rejects these violations, preventing HTTP request smuggling.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. Target Jetty 10.0.26 is NOT AFFECTED by CVE-2017-7658. The upstream fix (commit a285deea by Greg Wilkins, May 2018) that prevents HTTP request smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding conflicts was already included in Jetty 10.0.26 when TuxCare onboarded it. The defense code validates headers and rejects conflicting combinations with 400 Bad Request by default (RFC7230 compliance mode).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "Target Jetty 10.0.26 is NOT AFFECTED by CVE-2017-7658. The upstream fix (commit a285deea by Greg Wilkins, May 2018) that prevents HTTP request smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding conflicts was already included in Jetty 10.0.26 when TuxCare onboarded it. The defense code validates headers and rejects conflicting combinations with 400 Bad Request by default (RFC7230 compliance mode).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. CVE-2017-9735 (timing channel attack in password comparison) is NOT present in Jetty 10.0.26. The vulnerability was fixed by upstream author Simone Bordet in May 2017 (commit 042f325f1cd) by replacing timing-vulnerable string comparison methods (String.equals(), equalsIgnoreCase(), Arrays.equals()) with constant-time comparison functions (stringEquals() and byteEquals()). This fix was included in all Jetty 10.x releases starting from 10.0.0-alpha0. The target version 10.0.26, onboarded by TuxCare in September 2024 via commit 961b5988ccd, inherited this fix from the upstream release. All password comparison code paths in Password.java, Credential.java, and DigestAuthenticator.java use the constant-time comparison methods, preventing timing information leakage.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 (timing channel attack in password comparison) is NOT present in Jetty 10.0.26. The vulnerability was fixed by upstream author Simone Bordet in May 2017 (commit 042f325f1cd) by replacing timing-vulnerable string comparison methods (String.equals(), equalsIgnoreCase(), Arrays.equals()) with constant-time comparison functions (stringEquals() and byteEquals()). This fix was included in all Jetty 10.x releases starting from 10.0.0-alpha0. The target version 10.0.26, onboarded by TuxCare in September 2024 via commit 961b5988ccd, inherited this fix from the upstream release. All password comparison code paths in Password.java, Credential.java, and DigestAuthenticator.java use the constant-time comparison methods, preventing timing information leakage.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 affects Eclipse Jetty Server (all 9.x versions) where malformed HTTP requests with bad path characters trigger InvalidPathException that reveals the full filesystem path in error responses. The target repository (Jetty 10.0.26-tuxcare.3) is NOT AFFECTED because the upstream vendor fix (commit ad4dceb1c08 from May 2018) was already present in the upstream Jetty 10.0.26 release tha...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 affects Eclipse Jetty Server (all 9.x versions) where malformed HTTP requests with bad path characters trigger InvalidPathException that reveals the full filesystem path in error responses. The target repository (Jetty 10.0.26-tuxcare.3) is NOT AFFECTED because the upstream vendor fix (commit ad4dceb1c08 from May 2018) was already present in the upstream Jetty 10.0.26 release tha..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. CVE-2018-12545 does not affect Jetty 10.0.26. The vulnerability involved DoS through either large SETTINGS frames with many keys or flooding with many small SETTINGS frames. The upstream Jetty project fixed this in commits 9eca404da29 (July 2018, adding maxSettingsKeys limit) and 508ad4aff91 (August 2019, adding RateControl). Both fixes were included in Jetty 10.0.0-alpha0 and all subsequent releases. The target version 10.0.26 ships with both defenses: (1) per-frame key limit (SettingsBodyParser checks keys > maxKeys, default 64), and (2) rate control via WindowRateControl limiting frames per time window. These are upstream fixes authored by simone.bordet@gmail.com, present in the release that TuxCare onboarded (commit 961b5988c \"setup 10.0.26\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 does not affect Jetty 10.0.26. The vulnerability involved DoS through either large SETTINGS frames with many keys or flooding with many small SETTINGS frames. The upstream Jetty project fixed this in commits 9eca404da29 (July 2018, adding maxSettingsKeys limit) and 508ad4aff91 (August 2019, adding RateControl). Both fixes were included in Jetty 10.0.0-alpha0 and all subsequent releases. The target version 10.0.26 ships with both defenses: (1) per-frame key limit (SettingsBodyParser checks keys > maxKeys, default 64), and (2) rate control via WindowRateControl limiting frames per time window. These are upstream fixes authored by simone.bordet@gmail.com, present in the release that TuxCare onboarded (commit 961b5988c \"setup 10.0.26\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 is not present in Jetty 10.0.26. The upstream fix (commit 1565b5f160e) was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded. The fix adds proper URL decoding and HTML encoding to directory listings via the getFileName() method, hrefEncodeURI(), and deTag() functions, preventing XSS attacks through specially formatted filenames. The vulnerable pattern ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 is not present in Jetty 10.0.26. The upstream fix (commit 1565b5f160e) was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded. The fix adds proper URL decoding and HTML encoding to directory listings via the getFileName() method, hrefEncodeURI(), and deTag() functions, preventing XSS attacks through specially formatted filenames. The vulnerable pattern ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 does not affect this target. The vulnerability (directory listing exposing full filesystem paths on Windows) was fixed in upstream commit 7b774d82e82 by Joakim Erdfelt in April 2019. This fix was already present in upstream Jetty 10.0.26 before TuxCare onboarded the version. The target code at jetty-util/src/main/java/org/eclipse/jetty/util/resource/Resource.java contains the com...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 does not affect this target. The vulnerability (directory listing exposing full filesystem paths on Windows) was fixed in upstream commit 7b774d82e82 by Joakim Erdfelt in April 2019. This fix was already present in upstream Jetty 10.0.26 before TuxCare onboarded the version. The target code at jetty-util/src/main/java/org/eclipse/jetty/util/resource/Resource.java contains the com..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 10.0.26 is not affected by CVE-2019-10247. The vulnerability (information disclosure of fully qualified directory base resource locations in 404 error pages) was fixed in upstream Jetty before version 10.0.26 was released. The vulnerable code pattern (calls to context.toString() that exposed base resource paths) is not present in the current DefaultHandler implementation. The fix...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 Target version 10.0.26 is not affected by CVE-2019-10247. The vulnerability (information disclosure of fully qualified directory base resource locations in 404 error pages) was fixed in upstream Jetty before version 10.0.26 was released. The vulnerable code pattern (calls to context.toString() that exposed base resource paths) is not present in the current DefaultHandler implementation. The fix..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Eclipse Jetty 10.0.26-tuxcare.3) is NOT AFFECTED by CVE-2019-17632. The vulnerability was fixed upstream in commits 9e40fc9a6fb and cf0df6e3ffd by Joakim Erdfelt before the 10.0.26 release. TuxCare onboarded Jetty 10.0.26 which already contained these security fixes. The ErrorHandler.java code at HEAD shows that both text/html and text/json error outputs properly sanitize...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 The target repository (Eclipse Jetty 10.0.26-tuxcare.3) is NOT AFFECTED by CVE-2019-17632. The vulnerability was fixed upstream in commits 9e40fc9a6fb and cf0df6e3ffd by Joakim Erdfelt before the 10.0.26 release. TuxCare onboarded Jetty 10.0.26 which already contained these security fixes. The ErrorHandler.java code at HEAD shows that both text/html and text/json error outputs properly sanitize..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. CVE-2019-17638 affects Jetty 9.4.27-9.4.29, describing a double-release vulnerability in ByteBuffer handling when response headers exceed size limits. The target (Jetty 10.0.26-tuxcare.3) does not contain this vulnerability. The upstream fix (commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba, authored by gregw@webtide.com) was already present in Jetty 10.0.x before TuxCare onboarded version 10.0.26. The fix moved buffer lifecycle management into SendCallback scope, added releaseHeader()/releaseChunk() methods that null references after release, and modified HEADER_OVERFLOW handling to prevent double-release. Code examination confirms all aspects of the fix are present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "CVE-2019-17638 affects Jetty 9.4.27-9.4.29, describing a double-release vulnerability in ByteBuffer handling when response headers exceed size limits. The target (Jetty 10.0.26-tuxcare.3) does not contain this vulnerability. The upstream fix (commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba, authored by gregw@webtide.com) was already present in Jetty 10.0.x before TuxCare onboarded version 10.0.26. The fix moved buffer lifecycle management into SendCallback scope, added releaseHeader()/releaseChunk() methods that null references after release, and modified HEADER_OVERFLOW handling to prevent double-release. Code examination confirms all aspects of the fix are present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 is not present in Jetty 10.0.26. The vulnerability involved unconsumed GZIP-inflated request body data leaking across requests on persistent HTTP connections. The upstream fix (commit 14f94f738df5) was already included in the Jetty 10.0.26 release that TuxCare onboarded. All key defensive components are present: GzipHttpInputInterceptor.failed() properly releases decoder resource...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 is not present in Jetty 10.0.26. The vulnerability involved unconsumed GZIP-inflated request body data leaking across requests on persistent HTTP connections. The upstream fix (commit 14f94f738df5) was already included in the Jetty 10.0.26 release that TuxCare onboarded. All key defensive components are present: GzipHttpInputInterceptor.failed() properly releases decoder resource..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223 affects Jetty versions 10.0.0 and earlier due to an O(n\u00b2) bubble sort algorithm in QuotedQualityCSV that causes CPU exhaustion when processing headers with many quality parameters. The target (Jetty 10.0.26-tuxcare.3) contains the upstream fix from version 10.0.1, which replaced the inefficient sorting with an O(n log n) comparator-based sort. The fix was already present in the u...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27223 affects Jetty versions 10.0.0 and earlier due to an O(n\u00b2) bubble sort algorithm in QuotedQualityCSV that causes CPU exhaustion when processing headers with many quality parameters. The target (Jetty 10.0.26-tuxcare.3) contains the upstream fix from version 10.0.1, which replaced the inefficient sorting with an O(n log n) comparator-based sort. The fix was already present in the u..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. CVE-2021-28165 (Jetty TLS frame DoS causing CPU exhaustion) is NOT present in this target. The upstream fix by Simone Bordet (commit 039c7386d0f) was already included in the Jetty 10.0.26 release that TuxCare onboarded. The fix adds validation in SslConnection.unwrap() to detect when a large TLS frame causes buffer exhaustion (BUFFER_UNDERFLOW with no remaining buffer space) and terminates the connection with SSLHandshakeException instead of looping indefinitely. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "CVE-2021-28165 (Jetty TLS frame DoS causing CPU exhaustion) is NOT present in this target. The upstream fix by Simone Bordet (commit 039c7386d0f) was already included in the Jetty 10.0.26 release that TuxCare onboarded. The fix adds validation in SslConnection.unwrap() to detect when a large TLS frame causes buffer exhaustion (BUFFER_UNDERFLOW with no remaining buffer space) and terminates the connection with SSLHandshakeException instead of looping indefinitely. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 affects version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "action_statement": "Vulnerability CVE-2021-34428 affects version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. The target Jetty 10.0.26 repository is not affected by CVE-2022-2191. The vulnerability involved ByteBuffer memory leaks in SslConnection when TLS handshake errors occurred (e.g., expired client certificates). The upstream fix (commit 66de7ba6180) added explicit buffer cleanup methods and invoked them in all error handlers. This fix was already present in the upstream Jetty 10.0.26 release when TuxCare onboarded it, confirmed via git history analysis showing the fix commit is an ancestor of the first TuxCare commit (961b5988c \"setup 10.0.26\"). All five error paths from the patch are verified present in the target's SslConnection.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "The target Jetty 10.0.26 repository is not affected by CVE-2022-2191. The vulnerability involved ByteBuffer memory leaks in SslConnection when TLS handshake errors occurred (e.g., expired client certificates). The upstream fix (commit 66de7ba6180) added explicit buffer cleanup methods and invoked them in all error handlers. This fix was already present in the upstream Jetty 10.0.26 release when TuxCare onboarded it, confirmed via git history analysis showing the fix commit is an ancestor of the first TuxCare commit (961b5988c \"setup 10.0.26\"). All five error paths from the patch are verified present in the target's SslConnection.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 10.0.26) is NOT affected by CVE-2023-26048. The vulnerability fix was already present in the upstream Jetty 10.0.26 release before TuxCare began maintaining this version. Both defenses from the upstream patch are present: (1) limit on number of multipart parts (_maxParts with default 1000), and (2) limit on cumulative size of parts without filenames (maxFormContentS...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 10.0.26) is NOT affected by CVE-2023-26048. The vulnerability fix was already present in the upstream Jetty 10.0.26 release before TuxCare began maintaining this version. Both defenses from the upstream patch are present: (1) limit on number of multipart parts (_maxParts with default 1000), and (2) limit on cumulative size of parts without filenames (maxFormContentS..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:31.713844+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 is fixed in version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2023-26049"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. The target version 10.0.26 is not affected by CVE-2024-13009. The vulnerability affects Jetty 9.4.0-9.4.56 due to improper buffer cleanup when gzip decompression fails. Version 10.0.x underwent a major architectural refactoring in March 2020 (commit 814dc69803f) that introduced the ContentProducer pattern. This refactored architecture has always included proper content buffer cleanup - the AsyncContentProducer.failCurrentContent() method nulls out _rawContent and _transformedContent after calling .failed(), which is exactly the protection the CVE patch adds to 9.4.x. The vulnerable pattern (missing null assignment after content failure) never existed in the 10.0.x architecture.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "The target version 10.0.26 is not affected by CVE-2024-13009. The vulnerability affects Jetty 9.4.0-9.4.56 due to improper buffer cleanup when gzip decompression fails. Version 10.0.x underwent a major architectural refactoring in March 2020 (commit 814dc69803f) that introduced the ContentProducer pattern. This refactored architecture has always included proper content buffer cleanup - the AsyncContentProducer.failCurrentContent() method nulls out _rawContent and _transformedContent after calling .failed(), which is exactly the protection the CVE patch adds to 9.4.x. The vulnerable pattern (missing null assignment after content failure) never existed in the 10.0.x architecture.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server. CVE-2024-7708 does not affect the target Jetty 10.0.26 because the fix commit (8259eabbc70) was already included in the upstream Jetty 10.0.26 release before TuxCare onboarded it. The vulnerability (memory leak when HTTP request body read returns 0 bytes) was fixed by upstream author Simone Bordet. The target code at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:377-404 contains the complete fix: releaseRequestBuffer() is called when filled <= 0 (line 385) and in the exception handler (lines 400-401).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "CVE-2024-7708 does not affect the target Jetty 10.0.26 because the fix commit (8259eabbc70) was already included in the upstream Jetty 10.0.26 release before TuxCare onboarded it. The vulnerability (memory leak when HTTP request body read returns 0 bytes) was fixed by upstream author Simone Bordet. The target code at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:377-404 contains the complete fix: releaseRequestBuffer() is called when filled <= 0 (line 385) and in the exception handler (lines 400-401).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 affects version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "action_statement": "Vulnerability CVE-2024-8184 affects version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 affects version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "action_statement": "Vulnerability CVE-2026-10051 affects version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 affects version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "action_statement": "Vulnerability CVE-2026-1605 affects version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    }
  ]
}