{
  "@id": "urn:uuid:2c38d760-1963-4d9e-a651-58d5aacefa70",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 36,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:46:52.268713+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-03T15:06:35.446673+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 affects ancient Jetty versions (4.x-6.x from 2006) that used java.util.Random for session ID generation. Target Jetty 10.0.29 uses java.security.SecureRandom by default (DefaultSessionIdManager.java:359), with java.util.Random only as a fallback if SecureRandom initialization fails. The vulnerable code pattern (using weak Random as primary generator) is not present. This fix was s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 affects ancient Jetty versions (4.x-6.x from 2006) that used java.util.Random for session ID generation. Target Jetty 10.0.29 uses java.security.SecureRandom by default (DefaultSessionIdManager.java:359), with java.util.Random only as a fallback if SecureRandom initialization fails. The vulnerable code pattern (using weak Random as primary generator) is not present. This fix was s..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 (hash collision DoS via unlimited form parameters) is NOT present in Jetty 10.0.29. The target contains the complete upstream fix (commit 085c79d7d6c from 2011-12-30) that implements maxFormKeys limiting (default 1000) with checkMaxKeys() enforcement throughout UrlEncoded.java. This defense was authored by upstream Jetty developer Greg Wilkins and shipped in all Jetty 10.x release...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-4461 (hash collision DoS via unlimited form parameters) is NOT present in Jetty 10.0.29. The target contains the complete upstream fix (commit 085c79d7d6c from 2011-12-30) that implements maxFormKeys limiting (default 1000) with checkMaxKeys() enforcement throughout UrlEncoded.java. This defense was authored by upstream Jetty developer Greg Wilkins and shipped in all Jetty 10.x release..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-06T17:46:52.268713+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.29 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.29 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-03T15:28:17.034118+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, allowing attackers to bypass protected resource restrictions via URLs with escaped backslash characters. The target version 10.0.29 is NOT affected because the upstream fix (commit 97af3d663fd by Joakim Erdfelt, May 2016) was already included in the upstream release before TuxCare maintenance began. The fix tracks the original U...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, allowing attackers to bypass protected resource restrictions via URLs with escaped backslash characters. The target version 10.0.29 is NOT affected because the upstream fix (commit 97af3d663fd by Joakim Erdfelt, May 2016) was already included in the upstream release before TuxCare maintenance began. The fix tracks the original U..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-03T12:42:49.066061+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. CVE-2017-7656 (HTTP Request Smuggling) does not affect Eclipse Jetty 10.0.29 in its default configuration. The upstream fix (commit a285deea42f by Greg Wilkins) was already present in Jetty 10.0.26 before TuxCare onboarded this version. The target's HttpParser implements defense mechanisms that reject requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers in the default RFC7230 compliance mode. While the vulnerability pattern could theoretically be allowed in non-default RFC2616_LEGACY mode, this requires explicit configuration and does not affect the default secure configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "CVE-2017-7656 (HTTP Request Smuggling) does not affect Eclipse Jetty 10.0.29 in its default configuration. The upstream fix (commit a285deea42f by Greg Wilkins) was already present in Jetty 10.0.26 before TuxCare onboarded this version. The target's HttpParser implements defense mechanisms that reject requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers in the default RFC7230 compliance mode. While the vulnerability pattern could theoretically be allowed in non-default RFC2616_LEGACY mode, this requires explicit configuration and does not affect the default secure configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-03T12:19:18.164920+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. Jetty 10.0.29 is not affected by CVE-2017-7658 (HTTP Request Smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked). The upstream vendor fix (commit a285deea by Greg Wilkins, May 2018) was already present in Jetty 10.0.26, which TuxCare onboarded as the base release. The target contains comprehensive defenses that reject malformed requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers, preventing request smuggling attacks. Default compliance mode (RFC7230) enforces strict header validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "Jetty 10.0.29 is not affected by CVE-2017-7658 (HTTP Request Smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked). The upstream vendor fix (commit a285deea by Greg Wilkins, May 2018) was already present in Jetty 10.0.26, which TuxCare onboarded as the base release. The target contains comprehensive defenses that reject malformed requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers, preventing request smuggling attacks. Default compliance mode (RFC7230) enforces strict header validation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-03T12:31:15.270922+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. The timing channel vulnerability (CVE-2017-9735) is not present in Jetty 10.0.29. The vulnerable pattern (direct string/byte comparisons for password validation using String.equals() or Arrays.equals()) was removed by upstream commit 042f325f1cd6e7891d72c7e668f5947b5457dc02, which introduced constant-time comparison methods stringEquals() and byteEquals(). This fix was already present in the upstream Jetty release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (1410663ed9616242fb63a740f0b2a1a324639553). The current implementation in HEAD includes the original fix plus subsequent enhancements (commit e727ad893d2c3415645153807a8763a499090dc3) that further improved the constant-time comparison logic to prevent password length inference and avoid ArithmeticException edge cases.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "The timing channel vulnerability (CVE-2017-9735) is not present in Jetty 10.0.29. The vulnerable pattern (direct string/byte comparisons for password validation using String.equals() or Arrays.equals()) was removed by upstream commit 042f325f1cd6e7891d72c7e668f5947b5457dc02, which introduced constant-time comparison methods stringEquals() and byteEquals(). This fix was already present in the upstream Jetty release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (1410663ed9616242fb63a740f0b2a1a324639553). The current implementation in HEAD includes the original fix plus subsequent enhancements (commit e727ad893d2c3415645153807a8763a499090dc3) that further improved the constant-time comparison logic to prevent password length inference and avoid ArithmeticException edge cases.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-31T18:07:40.353277+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 is NOT present in Jetty 10.0.29. The vulnerability (path disclosure via InvalidPathException in error responses) was fixed upstream in commit ad4dceb1c08 (Issue #2560) before TuxCare began maintaining this version. The fix sanitizes exception messages in ResourceContentFactory.getContent() by catching all exceptions during resource loading and re-throwing a sanitized InvalidPathE...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 is NOT present in Jetty 10.0.29. The vulnerability (path disclosure via InvalidPathException in error responses) was fixed upstream in commit ad4dceb1c08 (Issue #2560) before TuxCare began maintaining this version. The fix sanitizes exception messages in ResourceContentFactory.getContent() by catching all exceptions during resource loading and re-throwing a sanitized InvalidPathE..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. The target Jetty 10.0.29 is NOT affected by CVE-2018-12545. The upstream fix for this HTTP/2 SETTINGS frame DoS vulnerability was already present in the Jetty release when TuxCare onboarded version 10.0.26. The fix includes: (1) a maxKeys limit (default 64) preventing processing of excessive setting key-value pairs, and (2) rate control for SETTINGS frames. Both defenses were authored by upstream Jetty developers (simone.bordet@gmail.com) in 2018-2019 and shipped in the upstream release before TuxCare's December 2025 onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "The target Jetty 10.0.29 is NOT affected by CVE-2018-12545. The upstream fix for this HTTP/2 SETTINGS frame DoS vulnerability was already present in the Jetty release when TuxCare onboarded version 10.0.26. The fix includes: (1) a maxKeys limit (default 64) preventing processing of excessive setting key-value pairs, and (2) rate control for SETTINGS frames. Both defenses were authored by upstream Jetty developers (simone.bordet@gmail.com) in 2018-2019 and shipped in the upstream release before TuxCare's December 2025 onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-31T16:06:54.632982+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 XSS vulnerability in directory listings is NOT present in the target. The upstream fix (commit 7b774d82e82 by Joakim Erdfelt) was already included in the upstream Jetty release before TuxCare onboarded version 10.0.26. The target code at version 10.0.29.tuxcare0003 contains the patched getFileName() method that properly extracts and URL-decodes filenames, preventing XSS through s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 XSS vulnerability in directory listings is NOT present in the target. The upstream fix (commit 7b774d82e82 by Joakim Erdfelt) was already included in the upstream Jetty release before TuxCare onboarded version 10.0.26. The target code at version 10.0.29.tuxcare0003 contains the patched getFileName() method that properly extracts and URL-decodes filenames, preventing XSS through s..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 describes a Windows-specific information disclosure vulnerability where directory listings expose fully qualified filesystem paths. The target repository (Jetty 10.0.29.tuxcare0003) is not affected because the fix commit (7b774d82e82) was already present in the upstream Jetty 10.0.29 release before TuxCare onboarding. The vulnerable code pattern that directly used Resource.getNam...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 describes a Windows-specific information disclosure vulnerability where directory listings expose fully qualified filesystem paths. The target repository (Jetty 10.0.29.tuxcare0003) is not affected because the fix commit (7b774d82e82) was already present in the upstream Jetty 10.0.29 release before TuxCare onboarding. The vulnerable code pattern that directly used Resource.getNam..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-31T16:31:00.169715+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 affects Eclipse Jetty's DefaultHandler, which exposed configured base resource directory paths in 404 error responses via context.toString() calls. The target repository at version 10.0.29.tuxcare0003 is NOT AFFECTED because the upstream vendor (Eclipse Jetty) already fixed this vulnerability in commit 04c994712c0 (April 15, 2019, \"Issue #3555 - Do not reveal base resource in err...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 affects Eclipse Jetty's DefaultHandler, which exposed configured base resource directory paths in 404 error responses via context.toString() calls. The target repository at version 10.0.29.tuxcare0003 is NOT AFFECTED because the upstream vendor (Eclipse Jetty) already fixed this vulnerability in commit 04c994712c0 (April 15, 2019, \"Issue #3555 - Do not reveal base resource in err..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-02T19:15:55.561862+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 10.0.29.tuxcare0003) is NOT affected by CVE-2019-17632. The vulnerability (unescaped exception messages in error output enabling XSS) was fixed in upstream commits cf0df6e3ffd and 9e40fc9a6fb authored by Joakim Erdfelt on 2019-11-20. These fixes were already present in the upstream Jetty 10.0.26 release that TuxCare onboarded on 2025-12-12. The vulnerable code patte...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 10.0.29.tuxcare0003) is NOT affected by CVE-2019-17632. The vulnerability (unescaped exception messages in error output enabling XSS) was fixed in upstream commits cf0df6e3ffd and 9e40fc9a6fb authored by Joakim Erdfelt on 2019-11-20. These fixes were already present in the upstream Jetty 10.0.26 release that TuxCare onboarded on 2025-12-12. The vulnerable code patte..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. The target (Jetty 10.0.29) is not affected by CVE-2019-17638. The vulnerability involved a double-release of ByteBuffer in the HTTP response header handling code when headers exceeded size limits. The upstream fix (commit ff8ae56fa93 by Greg Wilkins) was already present in the Jetty 10.x lineage before TuxCare onboarded version 10.0.26. The fix introduced releaseHeader() and releaseChunk() helper methods that properly null buffer references after release, preventing the double-release that could cause cross-client data leakage. The target code at HttpConnection.java lines 895-907 shows these protective methods are in place, and the HEADER_OVERFLOW case (line 786) correctly calls releaseHeader() before throwing an exception.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "The target (Jetty 10.0.29) is not affected by CVE-2019-17638. The vulnerability involved a double-release of ByteBuffer in the HTTP response header handling code when headers exceeded size limits. The upstream fix (commit ff8ae56fa93 by Greg Wilkins) was already present in the Jetty 10.x lineage before TuxCare onboarded version 10.0.26. The fix introduced releaseHeader() and releaseChunk() helper methods that properly null buffer references after release, preventing the double-release that could cause cross-client data leakage. The target code at HttpConnection.java lines 895-907 shows these protective methods are in place, and the HEADER_OVERFLOW case (line 786) correctly calls releaseHeader() before throwing an exception.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-02T19:33:53.776679+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target repository org.eclipse.jetty:jetty-project version 10.0.29.tuxcare0003 is NOT AFFECTED by CVE-2020-27218. The vulnerability (unconsumed GZIP request body data leaking into subsequent requests on persistent connections) was fixed in upstream commit 14f94f738df by Greg Wilkins (gregw@webtide.com). This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded, 83...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 Target repository org.eclipse.jetty:jetty-project version 10.0.29.tuxcare0003 is NOT AFFECTED by CVE-2020-27218. The vulnerability (unconsumed GZIP request body data leaking into subsequent requests on persistent connections) was fixed in upstream commit 14f94f738df by Greg Wilkins (gregw@webtide.com). This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded, 83..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-02T19:27:33.940034+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223 affects Jetty's QuotedQualityCSV class, causing DoS through CPU exhaustion when processing HTTP headers with many quality parameters. The vulnerability stemmed from an inefficient O(n\u00b2) bubble-sort algorithm. The target (Jetty 10.0.29.tuxcare0003) is NOT AFFECTED because the upstream fix (commit 10e531756b9) was already present in the base version 10.0.26 that TuxCare onboarded. ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27223 affects Jetty's QuotedQualityCSV class, causing DoS through CPU exhaustion when processing HTTP headers with many quality parameters. The vulnerability stemmed from an inefficient O(n\u00b2) bubble-sort algorithm. The target (Jetty 10.0.29.tuxcare0003) is NOT AFFECTED because the upstream fix (commit 10e531756b9) was already present in the base version 10.0.26 that TuxCare onboarded. ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-03T12:25:55.953386+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. The target (Jetty 10.0.29) is not affected by CVE-2021-28165. The vulnerability (CPU exhaustion via infinite loop when processing large TLS frames) was fixed by upstream commit 96f707f74b9 (March 24, 2021) authored by Greg Wilkins, which shipped in upstream release 10.0.10 and all subsequent versions. The fix adds a buffer fullness check in the BUFFER_UNDERFLOW case that throws SSLHandshakeException when the encrypted input buffer has no remaining space, preventing the infinite loop. This upstream fix predates TuxCare's onboarding of version 10.0.26 (commit 1410663ed96, December 12, 2025), meaning the vulnerable code pattern was never present in any TuxCare-maintained version of 10.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "The target (Jetty 10.0.29) is not affected by CVE-2021-28165. The vulnerability (CPU exhaustion via infinite loop when processing large TLS frames) was fixed by upstream commit 96f707f74b9 (March 24, 2021) authored by Greg Wilkins, which shipped in upstream release 10.0.10 and all subsequent versions. The fix adds a buffer fullness check in the BUFFER_UNDERFLOW case that throws SSLHandshakeException when the encrypted input buffer has no remaining space, preventing the infinite loop. This upstream fix predates TuxCare's onboarding of version 10.0.26 (commit 1410663ed96, December 12, 2025), meaning the vulnerable code pattern was never present in any TuxCare-maintained version of 10.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 affects version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "action_statement": "Vulnerability CVE-2021-34428 affects version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. The target repository (Jetty 10.0.29) is NOT AFFECTED by CVE-2022-2191. The vulnerability fix was already present in the upstream release that TuxCare onboarded. The upstream commit 66de7ba6180 \"Improve ssl buffers handling\" (authored by Ludovic Orban) is in the target's history and predates all TuxCare commits. The fix ensures ByteBuffers are properly cleared and released in error paths during TLS handshake processing, preventing memory exhaustion from leaked buffers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "The target repository (Jetty 10.0.29) is NOT AFFECTED by CVE-2022-2191. The vulnerability fix was already present in the upstream release that TuxCare onboarded. The upstream commit 66de7ba6180 \"Improve ssl buffers handling\" (authored by Ludovic Orban) is in the target's history and predates all TuxCare commits. The fix ensures ByteBuffers are properly cleared and released in error paths during TLS handshake processing, preventing memory exhaustion from leaked buffers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-31T15:42:00.071887+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty 10.0.29 is not affected by CVE-2023-26048. The vulnerability (multipart request handling causing OutOfMemoryError through unbounded memory allocation) was fixed by upstream vendor commit 622befbd0d5 authored by lachlan@webtide.com. This fix shipped in the upstream Jetty 10.0.14 release (February 2023) before TuxCare onboarded version 10.0.26. Both required defenses are present and ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 10.0.29 is not affected by CVE-2023-26048. The vulnerability (multipart request handling causing OutOfMemoryError through unbounded memory allocation) was fixed by upstream vendor commit 622befbd0d5 authored by lachlan@webtide.com. This fix shipped in the upstream Jetty 10.0.14 release (February 2023) before TuxCare onboarded version 10.0.26. Both required defenses are present and ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-31T15:11:00.112604+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty 10.0.29 is NOT AFFECTED by CVE-2023-26049 (cookie smuggling via quoted values with semicolons). The upstream fix commit 7b8c2c1bf08 authored by simone.bordet@gmail.com was already present in the upstream release when TuxCare onboarded version 10.0.26. The vulnerable cookie parsing pattern is not present in the target. The RFC6265CookieParser properly rejects semicolons within quote...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 10.0.29 is NOT AFFECTED by CVE-2023-26049 (cookie smuggling via quoted values with semicolons). The upstream fix commit 7b8c2c1bf08 authored by simone.bordet@gmail.com was already present in the upstream release when TuxCare onboarded version 10.0.26. The vulnerable cookie parsing pattern is not present in the target. The RFC6265CookieParser properly rejects semicolons within quote..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. CVE-2024-13009 affects Jetty 9.4.0 to 9.4.56 where a buffer can be incorrectly released on gzip errors, causing data leakage between requests. The target version 10.0.29 is NOT affected because the vulnerable code pattern does not exist in the 10.0.x architecture. The 10.0.x series uses a ContentProducer abstraction that explicitly nullifies _rawContent and _transformedContent in failCurrentContent() when errors occur (AsyncContentProducer.java:220, 229), preventing buffer reuse. The 9.4.x patch added `if (_content == content) _content = null;` to fix missing nullification; this defense was already built into the 10.0.x design from the start.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "CVE-2024-13009 affects Jetty 9.4.0 to 9.4.56 where a buffer can be incorrectly released on gzip errors, causing data leakage between requests. The target version 10.0.29 is NOT affected because the vulnerable code pattern does not exist in the 10.0.x architecture. The 10.0.x series uses a ContentProducer abstraction that explicitly nullifies _rawContent and _transformedContent in failCurrentContent() when errors occur (AsyncContentProducer.java:220, 229), preventing buffer reuse. The 9.4.x patch added `if (_content == content) _content = null;` to fix missing nullification; this defense was already built into the 10.0.x design from the start.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. Target Jetty 10.0.29.tuxcare0003 is NOT AFFECTED. CVE-2024-7708 describes a memory leak when HTTP request bodies are read in operations that return 0 bytes, causing buffer pool exhaustion and DoS. The vulnerability was patched in upstream Jetty 10.0.23 (commit 8259eabbc70 by Simone Bordet, August 2024). The fix is present in the target at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java lines 381-386 and 398-402: buffers are now released via releaseRequestBuffer() when fills return \u22640 bytes or on exceptions. This fix shipped in the upstream release (10.0.26) that TuxCare onboarded, predating TuxCare's first commit (1410663ed96 \"setup 10.0.26\") by 1457 commits. The vulnerable pattern (unreleased buffers on 0-byte reads) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "Target Jetty 10.0.29.tuxcare0003 is NOT AFFECTED. CVE-2024-7708 describes a memory leak when HTTP request bodies are read in operations that return 0 bytes, causing buffer pool exhaustion and DoS. The vulnerability was patched in upstream Jetty 10.0.23 (commit 8259eabbc70 by Simone Bordet, August 2024). The fix is present in the target at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java lines 381-386 and 398-402: buffers are now released via releaseRequestBuffer() when fills return \u22640 bytes or on exceptions. This fix shipped in the upstream release (10.0.26) that TuxCare onboarded, predating TuxCare's first commit (1410663ed96 \"setup 10.0.26\") by 1457 commits. The vulnerable pattern (unreleased buffers on 0-byte reads) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 10.0.29 is not affected by CVE-2026-10051. The vulnerability concerns connection-scoped trailer state in Jetty 12+ that persists across requests, but Jetty 10.0.29 uses a different architecture where trailers are channel-scoped and properly reset between requests via the channel recycle mechanism.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 10.0.29 is not affected by CVE-2026-10051. The vulnerability concerns connection-scoped trailer state in Jetty 12+ that persists across requests, but Jetty 10.0.29 uses a different architecture where trailers are channel-scoped and properly reset between requests via the channel recycle mechanism."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 10.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    }
  ]
}