{
  "@id": "urn:uuid:5bea8ebd-a76e-4356-a548-bebf7dc179c8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:47:10.017438+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T15:08:44.196020+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 affects Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3 due to predictable session IDs generated using java.util.Random. The target (Jetty 10.0.30) uses SecureRandom by default for session ID generation, with the fix applied by upstream vendor in 2010 (commit c3275730b913f3990560ac2df2b1b8b2e9e7e69a, \"JETTY-1202 Use platform default algorithm for SecureRandom\"). The fix...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 affects Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3 due to predictable session IDs generated using java.util.Random. The target (Jetty 10.0.30) uses SecureRandom by default for session ID generation, with the fix applied by upstream vendor in 2010 (commit c3275730b913f3990560ac2df2b1b8b2e9e7e69a, \"JETTY-1202 Use platform default algorithm for SecureRandom\"). The fix..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 10.0.30.tuxcare0002 is NOT AFFECTED by CVE-2011-4461. The vulnerability (unbounded form parameter parsing enabling hash collision DoS attacks) is not present because the upstream Jetty project fixed it in commit 085c79d7d6cfbccc02821ffdb64968593df3e0bf by Greg Wilkins, which introduced the maxFormKeys limit (default 1000). This fix was already included in the upstream Jetty 10....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 10.0.30.tuxcare0002 is NOT AFFECTED by CVE-2011-4461. The vulnerability (unbounded form parameter parsing enabling hash collision DoS attacks) is not present because the upstream Jetty project fixed it in commit 085c79d7d6cfbccc02821ffdb64968593df3e0bf by Greg Wilkins, which introduced the maxFormKeys limit (default 1000). This fix was already included in the upstream Jetty 10...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-06T17:47:10.017438+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.30 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.30 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T15:28:54.426721+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, allowing path traversal via escaped backslashes in URLs. The target (Jetty 10.0.30) is NOT affected because the vulnerability was fixed in upstream commit 97af3d663fd (May 13, 2016) by Joakim Erdfelt, which shipped in Jetty 9.3.9 - well before TuxCare onboarded version 10.0.26. The fix preserves the original URI alongside the fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, allowing path traversal via escaped backslashes in URLs. The target (Jetty 10.0.30) is NOT affected because the vulnerability was fixed in upstream commit 97af3d663fd (May 13, 2016) by Joakim Erdfelt, which shipped in Jetty 9.3.9 - well before TuxCare onboarded version 10.0.26. The fix preserves the original URI alongside the fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T12:42:49.066061+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2017-7656 (HTTP Request Smuggling via conflicting Content-Length/Transfer-Encoding headers) is NOT present in Jetty 10.0.30. The upstream fix (commit a285deea42f by Greg Wilkins, May 2018) was already included in the upstream release before TuxCare onboarded version 10.0.26 (Dec 2025). The target code contains robust defenses: duplicate Content-Length detection (_hasContentLength flag), mutual exclusion checks for Content-Length + Transfer-Encoding: chunked (TRANSFER_ENCODING_WITH_CONTENT_LENGTH violation), and strict RFC7230 compliance by default. The parser throws BadMessageException when these violations are detected, preventing request smuggling attacks. Defense code verified at HttpParser.java lines 997-1019 with default compliance mode RFC7230 (line 74 of HttpConfiguration.java).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "CVE-2017-7656 (HTTP Request Smuggling via conflicting Content-Length/Transfer-Encoding headers) is NOT present in Jetty 10.0.30. The upstream fix (commit a285deea42f by Greg Wilkins, May 2018) was already included in the upstream release before TuxCare onboarded version 10.0.26 (Dec 2025). The target code contains robust defenses: duplicate Content-Length detection (_hasContentLength flag), mutual exclusion checks for Content-Length + Transfer-Encoding: chunked (TRANSFER_ENCODING_WITH_CONTENT_LENGTH violation), and strict RFC7230 compliance by default. The parser throws BadMessageException when these violations are detected, preventing request smuggling attacks. Defense code verified at HttpParser.java lines 997-1019 with default compliance mode RFC7230 (line 74 of HttpConfiguration.java).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T12:20:19.402749+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. Jetty 10.0.30 is not affected by CVE-2017-7658 (HTTP Request Smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked). The vulnerability was fixed by upstream Eclipse Jetty in commit a652ce20ee7 (March 2019, Greg Wilkins) which refactored the HttpCompliance system to reject both attack vectors. This fix was already present in the upstream release when TuxCare began maintaining version 10.0.26. The default RFC7230 compliance mode actively blocks both attack patterns with 400 Bad Request, preventing request body content from being interpreted as a pipelined request.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "Jetty 10.0.30 is not affected by CVE-2017-7658 (HTTP Request Smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked). The vulnerability was fixed by upstream Eclipse Jetty in commit a652ce20ee7 (March 2019, Greg Wilkins) which refactored the HttpCompliance system to reject both attack vectors. This fix was already present in the upstream release when TuxCare began maintaining version 10.0.26. The default RFC7230 compliance mode actively blocks both attack patterns with 400 Bad Request, preventing request body content from being interpreted as a pipelined request.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T12:32:43.249791+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2017-9735 timing channel vulnerability is NOT present in Jetty 10.0.30. The vulnerability concerned non-constant-time password comparison in Password.java that could leak information about password correctness through response time measurements. The target repository already contains the upstream fix (constant-time stringEquals/byteEquals methods) which was shipped in the upstream Jetty release before TuxCare onboarded version 10.0.26. All password comparisons in Password.java (lines 95, 98, 116, 119) and credential types (Crypt, MD5) use constant-time comparison methods that prevent timing attacks. Fix commit 2baa1abe4b1 by simone.bordet@gmail.com predates the first TuxCare commit (setup 10.0.26, b53758d414f) and is an ancestor of HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 timing channel vulnerability is NOT present in Jetty 10.0.30. The vulnerability concerned non-constant-time password comparison in Password.java that could leak information about password correctness through response time measurements. The target repository already contains the upstream fix (constant-time stringEquals/byteEquals methods) which was shipped in the upstream Jetty release before TuxCare onboarded version 10.0.26. All password comparisons in Password.java (lines 95, 98, 116, 119) and credential types (Crypt, MD5) use constant-time comparison methods that prevent timing attacks. Fix commit 2baa1abe4b1 by simone.bordet@gmail.com predates the first TuxCare commit (setup 10.0.26, b53758d414f) and is an ancestor of HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T18:08:51.536561+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 affects Eclipse Jetty Server 9.x versions where InvalidPathException messages containing full filesystem paths are exposed in error responses when bad URL paths trigger path validation errors. The target repository (Jetty 10.0.30.tuxcare0002) is NOT affected because the fix was already present in the upstream release before TuxCare onboarding. The fix, implemented in ResourceCont...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 affects Eclipse Jetty Server 9.x versions where InvalidPathException messages containing full filesystem paths are exposed in error responses when bad URL paths trigger path validation errors. The target repository (Jetty 10.0.30.tuxcare0002) is NOT affected because the fix was already present in the upstream release before TuxCare onboarding. The fix, implemented in ResourceCont..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2018-12545 is not present in Jetty 10.0.30. The vulnerability describes a DoS condition caused by processing large SETTINGS frames with many settings or many small SETTINGS frames that exhaust CPU and memory. The upstream Jetty project fixed this in commits 9eca404da29 (issue #2722, adding maxSettingsKeys limit) and cfe1baa0482 (issue #3978, adding comprehensive rate control). Both fixes are present in the target at jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/parser/SettingsBodyParser.java and related files. These fixes were shipped in the upstream Jetty release before TuxCare began maintaining version 10.0.26, so they were present from the beginning of TuxCare's 10.x maintenance branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 is not present in Jetty 10.0.30. The vulnerability describes a DoS condition caused by processing large SETTINGS frames with many settings or many small SETTINGS frames that exhaust CPU and memory. The upstream Jetty project fixed this in commits 9eca404da29 (issue #2722, adding maxSettingsKeys limit) and cfe1baa0482 (issue #3978, adding comprehensive rate control). Both fixes are present in the target at jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/parser/SettingsBodyParser.java and related files. These fixes were shipped in the upstream Jetty release before TuxCare began maintaining version 10.0.26, so they were present from the beginning of TuxCare's 10.x maintenance branch.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T16:10:55.351023+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 affects directory listing XSS in Eclipse Jetty 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older. The target (10.0.30) is not affected because the fix (commit 7b774d82e82 from April 2019) was already present in the upstream release before TuxCare onboarded version 10.0.26. The code uses getFileName() to extract only the filename component and deTag()/sanitizeXmlString() to...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 affects directory listing XSS in Eclipse Jetty 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older. The target (10.0.30) is not affected because the fix (commit 7b774d82e82 from April 2019) was already present in the upstream release before TuxCare onboarded version 10.0.26. The code uses getFileName() to extract only the filename component and deTag()/sanitizeXmlString() to..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target is NOT AFFECTED by CVE-2019-10246. The vulnerability (exposure of fully qualified filesystem paths in directory listings) has been fixed by upstream commit 7b774d82e82 authored by joakim.erdfelt@gmail.com. This fix was already present in upstream Jetty release 10.0.26, which TuxCare onboarded via commit b53758d414f. The vulnerable pattern (using getName() with manual string extractio...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 The target is NOT AFFECTED by CVE-2019-10246. The vulnerability (exposure of fully qualified filesystem paths in directory listings) has been fixed by upstream commit 7b774d82e82 authored by joakim.erdfelt@gmail.com. This fix was already present in upstream Jetty release 10.0.26, which TuxCare onboarded via commit b53758d414f. The vulnerable pattern (using getName() with manual string extractio..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T16:34:00.087449+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247: Target version 10.0.30 is NOT AFFECTED. The vulnerability (information disclosure of filesystem base resource paths via DefaultHandler's 404 error page) was fixed by upstream Jetty developer Joakim Erdfelt in commit 04c994712c0 (April 2019), which removed the output of context.toString() from the error HTML. This fix was already present in the upstream Jetty 10.0.26 release that...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247: Target version 10.0.30 is NOT AFFECTED. The vulnerability (information disclosure of filesystem base resource paths via DefaultHandler's 404 error page) was fixed by upstream Jetty developer Joakim Erdfelt in commit 04c994712c0 (April 2019), which removed the output of context.toString() from the error HTML. This fix was already present in the upstream Jetty 10.0.26 release that..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T19:15:55.561862+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty 10.0.30 is not affected by CVE-2019-17632. The vulnerability (unescaped exception messages in error pages enabling XSS) is not present because an upstream fix was already included in the release. The fix applies StringUtil.sanitizeXmlString() to all exception messages and stack traces before rendering them in HTML and JSON error responses. Fix commit cf0df6e3ffdcd64d607a35488edb5b0...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 10.0.30 is not affected by CVE-2019-17632. The vulnerability (unescaped exception messages in error pages enabling XSS) is not present because an upstream fix was already included in the release. The fix applies StringUtil.sanitizeXmlString() to all exception messages and stack traces before rendering them in HTML and JSON error responses. Fix commit cf0df6e3ffdcd64d607a35488edb5b0..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. Jetty 10.0.30 is not affected by CVE-2019-17638. The vulnerable double-release pattern described in the CVE (ByteBuffer released twice when handling oversized response headers, leading to response data leakage between clients) is not present in the target. The upstream fix (commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba by Greg Wilkins) was shipped in Jetty 9.4.30 (June 2020) and carried forward to Jetty 10.0.26, which predates the TuxCare onboarding. The target contains proper buffer management with releaseHeader() and releaseChunk() methods that null references after releasing buffers, preventing the double-release vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "Jetty 10.0.30 is not affected by CVE-2019-17638. The vulnerable double-release pattern described in the CVE (ByteBuffer released twice when handling oversized response headers, leading to response data leakage between clients) is not present in the target. The upstream fix (commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba by Greg Wilkins) was shipped in Jetty 9.4.30 (June 2020) and carried forward to Jetty 10.0.26, which predates the TuxCare onboarding. The target contains proper buffer management with releaseHeader() and releaseChunk() methods that null references after releasing buffers, preventing the double-release vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T19:35:59.588299+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 (GZIP request body data injection vulnerability) is NOT present in target Jetty 10.0.30. The vulnerability fix (commit 14f94f738df) was already included in the upstream Jetty release before TuxCare onboarded version 10.0.26. The defense mechanism\u2014ensureConsumeAllOrNotPersistent() which consumes unconsumed input OR sets Connection: close\u2014is fully implemented and active by default ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 (GZIP request body data injection vulnerability) is NOT present in target Jetty 10.0.30. The vulnerability fix (commit 14f94f738df) was already included in the upstream Jetty release before TuxCare onboarded version 10.0.26. The defense mechanism\u2014ensureConsumeAllOrNotPersistent() which consumes unconsumed input OR sets Connection: close\u2014is fully implemented and active by default ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T19:27:33.940034+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223 affects Jetty's QuotedQualityCSV class due to an inefficient O(n\u00b2) sorting algorithm. The target repository (version 10.0.30) contains the fixed version with O(n log n) comparator-based sorting. The fix (commit 10e531756b9) was authored by upstream Jetty developer Joakim Erdfelt and was already present in the upstream release 10.0.26 before TuxCare onboarding. The vulnerable code...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27223 affects Jetty's QuotedQualityCSV class due to an inefficient O(n\u00b2) sorting algorithm. The target repository (version 10.0.30) contains the fixed version with O(n log n) comparator-based sorting. The fix (commit 10e531756b9) was authored by upstream Jetty developer Joakim Erdfelt and was already present in the upstream release 10.0.26 before TuxCare onboarding. The vulnerable code..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T12:26:45.505192+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2021-28165 affects Jetty's SSL/TLS handling when processing large encrypted frames (>17408 bytes), causing CPU exhaustion through infinite retry loops. The vulnerability was fixed by upstream Jetty developers in commits 039c7386d0f and 294b2ba02b6, which add validation to detect when the encrypted buffer is full and no progress is being made, throwing SSLHandshakeException to break the loop. These fixes were already present in the upstream Jetty 10.0.26 release that TuxCare onboarded for this ELS branch. The target repository at version 10.0.30 contains the complete fix in jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java at lines 756-760, where it checks for zero buffer space and aborts the connection. Since the fix shipped in the upstream release before TuxCare's involvement, the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "CVE-2021-28165 affects Jetty's SSL/TLS handling when processing large encrypted frames (>17408 bytes), causing CPU exhaustion through infinite retry loops. The vulnerability was fixed by upstream Jetty developers in commits 039c7386d0f and 294b2ba02b6, which add validation to detect when the encrypted buffer is full and no progress is being made, throwing SSLHandshakeException to break the loop. These fixes were already present in the upstream Jetty 10.0.26 release that TuxCare onboarded for this ELS branch. The target repository at version 10.0.30 contains the complete fix in jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java at lines 756-760, where it checks for zero buffer space and aborts the connection. Since the fix shipped in the upstream release before TuxCare's involvement, the verdict is not_affected rather than already_fixed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. Version 10.0.30 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "Version 10.0.30 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2022-2191 is not present in Jetty 10.0.30. The vulnerability (ByteBuffer memory leaks in SslConnection error paths during TLS handshake failures) was fixed by upstream commit 66de7ba6180 authored by Ludovic Orban, which was already included in the Jetty 10.0.26 upstream release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "CVE-2022-2191 is not present in Jetty 10.0.30. The vulnerability (ByteBuffer memory leaks in SslConnection error paths during TLS handshake failures) was fixed by upstream commit 66de7ba6180 authored by Ludovic Orban, which was already included in the Jetty 10.0.26 upstream release before TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T15:42:00.071887+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26048 is NOT present in Jetty 10.0.30.tuxcare0002. The vulnerability (unbounded memory consumption during multipart request parsing) was fixed in upstream Jetty 10.0.14 via PR #9344 (commit 622befbd0d5). This fix was already included in the upstream Jetty 10.0.30 release that TuxCare onboarded, predating all TuxCare modifications to this version. Both required defenses are present: (1)...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26048 is NOT present in Jetty 10.0.30.tuxcare0002. The vulnerability (unbounded memory consumption during multipart request parsing) was fixed in upstream Jetty 10.0.14 via PR #9344 (commit 622befbd0d5). This fix was already included in the upstream Jetty 10.0.30 release that TuxCare onboarded, predating all TuxCare modifications to this version. Both required defenses are present: (1)..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T15:11:00.112604+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 (cookie smuggling via nonstandard quoted-value parsing) is NOT present in Jetty 10.0.30. The upstream fix from PR #9339 (commit 7b8c2c1bf08) shipped in Jetty 10.0.14 and is present in this version. The RFC6265CookieParser correctly rejects cookies containing semicolons in quoted values by marking them invalid and preventing them from being added to the cookie handler, blocking th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via nonstandard quoted-value parsing) is NOT present in Jetty 10.0.30. The upstream fix from PR #9339 (commit 7b8c2c1bf08) shipped in Jetty 10.0.14 and is present in this version. The RFC6265CookieParser correctly rejects cookies containing semicolons in quoted values by marking them invalid and preventing them from being added to the cookie handler, blocking th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. Target version 10.0.30 is not affected by CVE-2024-13009. The upstream fix (commit e3fa9466633 by gregw@webtide.com, applied 2024-12-19) was already included in Jetty 10.0.26 before TuxCare onboarded this version (2025-12-12). The fix prevents buffer reuse across requests by nulling content references when gzip decompression errors occur. Verified in AsyncContentProducer.failCurrentContent() at lines 220 and 229.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "Target version 10.0.30 is not affected by CVE-2024-13009. The upstream fix (commit e3fa9466633 by gregw@webtide.com, applied 2024-12-19) was already included in Jetty 10.0.26 before TuxCare onboarded this version (2025-12-12). The fix prevents buffer reuse across requests by nulling content references when gzip decompression errors occur. Verified in AsyncContentProducer.failCurrentContent() at lines 220 and 229.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. The target repository (Jetty 10.0.30.tuxcare0002) is NOT AFFECTED by CVE-2024-7708. The vulnerability, which causes memory leaks when handling HTTP requests with bodies that may read 0 bytes (particularly 100-Continue requests), was fixed in upstream Jetty 10.0.23. The fix commit (8259eabbc70) is present in the target and was authored by upstream maintainer Simone Bordet. Since TuxCare based their 10.0.26 branch on upstream Jetty which already contained the fix (released 2024-08-14), no TuxCare backport was necessary for this CVE in the 10.0.x line. The vulnerable code pattern (buffer leak when fillRequestBuffer() reads 0 bytes) is not present because the upstream fix shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "The target repository (Jetty 10.0.30.tuxcare0002) is NOT AFFECTED by CVE-2024-7708. The vulnerability, which causes memory leaks when handling HTTP requests with bodies that may read 0 bytes (particularly 100-Continue requests), was fixed in upstream Jetty 10.0.23. The fix commit (8259eabbc70) is present in the target and was authored by upstream maintainer Simone Bordet. Since TuxCare based their 10.0.26 branch on upstream Jetty which already contained the fix (released 2024-08-14), no TuxCare backport was necessary for this CVE in the 10.0.x line. The vulnerable code pattern (buffer leak when fillRequestBuffer() reads 0 bytes) is not present because the upstream fix shipped with the base release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 10.0.30 is not affected by CVE-2026-10051. The CVE targets Jetty 12+ jetty-core architecture (jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/HttpConnection.java), which does not exist in Jetty 10. While Jetty 10 uses a different architecture (HttpChannelOverHttp.java) that processes HTTP trailers, it has an effective defense: the _trailers field is nulled in the r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 10.0.30 is not affected by CVE-2026-10051. The CVE targets Jetty 12+ jetty-core architecture (jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/HttpConnection.java), which does not exist in Jetty 10. While Jetty 10 uses a different architecture (HttpChannelOverHttp.java) that processes HTTP trailers, it has an effective defense: the _trailers field is nulled in the r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    }
  ]
}