{
  "@id": "urn:uuid:3fac93dc-46ef-43d2-920c-4f2b27f83a5b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 36,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T10:27:37.551355+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:08:01.045470+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 affects Jetty versions that used java.util.Random for session ID generation, making session identifiers predictable. The target (Jetty 10.0.31) is NOT AFFECTED because the vulnerable code pattern is not present. The code uses SecureRandom by default (DefaultSessionIdManager.java:359) with only a fallback to weak Random when SecureRandom initialization fails. The fix was introduced...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 affects Jetty versions that used java.util.Random for session ID generation, making session identifiers predictable. The target (Jetty 10.0.31) is NOT AFFECTED because the vulnerable code pattern is not present. The code uses SecureRandom by default (DefaultSessionIdManager.java:359) with only a fallback to weak Random when SecureRandom initialization fails. The fix was introduced..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target (Jetty 10.0.31.tuxcare0001) is NOT AFFECTED by CVE-2011-4461 (hash collision DoS via unbounded form parameters). The vulnerability pattern is not present because the upstream fix (commit 085c79d7d6c by Greg Wilkins, 2011-12-30) was already included in Jetty 10.0.26, which TuxCare onboarded as the base version. The fix introduces maxFormKeys protection (default 1000) that limits the n...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 The target (Jetty 10.0.31.tuxcare0001) is NOT AFFECTED by CVE-2011-4461 (hash collision DoS via unbounded form parameters). The vulnerability pattern is not present because the upstream fix (commit 085c79d7d6c by Greg Wilkins, 2011-12-30) was already included in Jetty 10.0.26, which TuxCare onboarded as the base version. The fix introduces maxFormKeys protection (default 1000) that limits the n..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T17:47:26.501853+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.31 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.31 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:28:54.426721+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Jetty 9.3.0-9.3.8 and involves a path normalization vulnerability on Windows allowing bypassing protected resources via URLs with escaped backslash characters. The target version 10.0.31 contains the upstream fix authored by Joakim Erdfelt (commit 97af3d663fd, May 2016) that was released in Jetty 9.3.9 and was already present in version 10.0.26 when TuxCare onboarded it. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Jetty 9.3.0-9.3.8 and involves a path normalization vulnerability on Windows allowing bypassing protected resources via URLs with escaped backslash characters. The target version 10.0.31 contains the upstream fix authored by Joakim Erdfelt (commit 97af3d663fd, May 2016) that was released in Jetty 9.3.9 and was already present in version 10.0.26 when TuxCare onboarded it. T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:43:54.437566+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Target version 10.0.31 is not affected by CVE-2017-7656 (HTTP Request Smuggling). The upstream fix (commit a285deea42f by Greg Wilkins, dated 2018-05-17) is present in the target and was shipped in all Jetty 10.x releases before TuxCare onboarded version 10.0.26. The fix adds validation to reject HTTP requests with both Content-Length and Transfer-Encoding headers, or multiple Content-Length headers. The default compliance mode (RFC7230) enforces these checks. While RFC2616_LEGACY mode allows these violations as documented legacy behavior, it requires explicit user configuration and is not the default. The vulnerable pattern is not present in standard deployments.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "Target version 10.0.31 is not affected by CVE-2017-7656 (HTTP Request Smuggling). The upstream fix (commit a285deea42f by Greg Wilkins, dated 2018-05-17) is present in the target and was shipped in all Jetty 10.x releases before TuxCare onboarded version 10.0.26. The fix adds validation to reject HTTP requests with both Content-Length and Transfer-Encoding headers, or multiple Content-Length headers. The default compliance mode (RFC7230) enforces these checks. While RFC2616_LEGACY mode allows these violations as documented legacy behavior, it requires explicit user configuration and is not the default. The vulnerable pattern is not present in standard deployments.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-09T10:27:37.551355+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: the upstream fix is already in this version's git history (commits 1a4d304a, 715a637c, a285deea, d35a332b, e05c11ae). Advisories: GitHub says fixed in 9.2.25 and 9.3.24 and NVD in 9.4.11, and this version is on a newer line; the cve.org record reads as affected only because it writes each range as two half-entries. Confirmed not affected by the Java ELS team review on 2026-11-06.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "impact_statement": "Prechecker: the upstream fix is already in this version's git history (commits 1a4d304a, 715a637c, a285deea, d35a332b, e05c11ae). Advisories: GitHub says fixed in 9.2.25 and 9.3.24 and NVD in 9.4.11, and this version is on a newer line; the cve.org record reads as affected only because it writes each range as two half-entries. Confirmed not affected by the Java ELS team review on 2026-11-06."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:21:26.071673+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Jetty 10.0.31 is NOT AFFECTED by CVE-2017-7658 (HTTP Request Smuggling via duplicate Content-Length or Content-Length + Transfer-Encoding conflicts). The vulnerability was fixed in upstream Jetty by commit a285deea42fc (Greg Wilkins, 2018-05-17) as part of RFC7230 compliance improvements, well before TuxCare onboarded version 10.0.26. The fix adds validation that rejects requests with multiple Content-Length headers or conflicting Content-Length + Transfer-Encoding headers, enabled by default via RFC7230 compliance mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "Jetty 10.0.31 is NOT AFFECTED by CVE-2017-7658 (HTTP Request Smuggling via duplicate Content-Length or Content-Length + Transfer-Encoding conflicts). The vulnerability was fixed in upstream Jetty by commit a285deea42fc (Greg Wilkins, 2018-05-17) as part of RFC7230 compliance improvements, well before TuxCare onboarded version 10.0.26. The fix adds validation that rejects requests with multiple Content-Length headers or conflicting Content-Length + Transfer-Encoding headers, enabled by default via RFC7230 compliance mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:32:43.249791+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-9735 (timing channel attack in password comparison) is NOT present in Jetty 10.0.31.tuxcare0001. The target repository contains constant-time comparison methods (stringEquals/byteEquals) that prevent timing side-channel attacks. The vulnerable pattern (using standard .equals() and Arrays.equals() which perform early-exit comparison) was removed by upstream commit 042f325f1cd authored by Simone Bordet. This fix was already included in the upstream Jetty 10.0.26 release before TuxCare onboarded it, making this an upstream vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 (timing channel attack in password comparison) is NOT present in Jetty 10.0.31.tuxcare0001. The target repository contains constant-time comparison methods (stringEquals/byteEquals) that prevent timing side-channel attacks. The vulnerable pattern (using standard .equals() and Arrays.equals() which perform early-exit comparison) was removed by upstream commit 042f325f1cd authored by Simone Bordet. This fix was already included in the upstream Jetty 10.0.26 release before TuxCare onboarded it, making this an upstream vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T18:12:00.148986+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 is NOT present in Jetty 10.0.31.tuxcare0001. The vulnerability allows filesystem path disclosure through InvalidPathException messages in error responses when malformed path characters are used. The upstream fix (commit ad4dceb1c08, Issue #2560) was already present in the upstream release that TuxCare onboarded at version 10.0.26. The fix sanitizes exceptions in ResourceContentFa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 is NOT present in Jetty 10.0.31.tuxcare0001. The vulnerability allows filesystem path disclosure through InvalidPathException messages in error responses when malformed path characters are used. The upstream fix (commit ad4dceb1c08, Issue #2560) was already present in the upstream release that TuxCare onboarded at version 10.0.26. The fix sanitizes exceptions in ResourceContentFa..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2018-12545 is NOT present in this target. The vulnerability affects Jetty 9.3.x and 9.4.x servers that lack limits on HTTP/2 SETTINGS frame processing, allowing DoS via resource exhaustion. The fix (limiting settings keys to 64 by default) was introduced by upstream Jetty developer Simone Bordet in commit 9eca404da29, shipped in Jetty 10.0.0. This target is version 10.0.31, which is based on the upstream Jetty 10.0.0+ releases that already contain the fix. The defense code exists at SettingsBodyParser.java:195-198, incrementing a keys counter and rejecting connections when keys exceed getMaxKeys(). TuxCare's maintenance of this version began at 10.0.26, after the fix was already in the upstream codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 is NOT present in this target. The vulnerability affects Jetty 9.3.x and 9.4.x servers that lack limits on HTTP/2 SETTINGS frame processing, allowing DoS via resource exhaustion. The fix (limiting settings keys to 64 by default) was introduced by upstream Jetty developer Simone Bordet in commit 9eca404da29, shipped in Jetty 10.0.0. This target is version 10.0.31, which is based on the upstream Jetty 10.0.0+ releases that already contain the fix. The defense code exists at SettingsBodyParser.java:195-198, incrementing a keys counter and rejecting connections when keys exceed getMaxKeys(). TuxCare's maintenance of this version began at 10.0.26, after the fix was already in the upstream codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:12:45.603403+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 is an XSS vulnerability in Jetty's directory listing feature where filenames containing HTML/JavaScript were not properly escaped. The target version 10.0.31.tuxcare0001 is NOT AFFECTED because upstream fixes were already present in version 10.0.26 that TuxCare onboarded. Two key commits (ca77bd384a2 from April 3, 2019 and 3d028ab2ca7 from April 15, 2019) introduced proper HTML e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 is an XSS vulnerability in Jetty's directory listing feature where filenames containing HTML/JavaScript were not properly escaped. The target version 10.0.31.tuxcare0001 is NOT AFFECTED because upstream fixes were already present in version 10.0.26 that TuxCare onboarded. Two key commits (ca77bd384a2 from April 3, 2019 and 3d028ab2ca7 from April 15, 2019) introduced proper HTML e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 affects Eclipse Jetty versions where directory listings exposed fully qualified filesystem paths on Windows. The target (Jetty 10.0.31.tuxcare0001) contains the upstream vendor fix introduced in commit 3d028ab2ca7 by Joakim Erdfelt. The fix adds a getFileName() method that extracts only the last path segment instead of the full path. This fix was already present in upstream Jetty...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 affects Eclipse Jetty versions where directory listings exposed fully qualified filesystem paths on Windows. The target (Jetty 10.0.31.tuxcare0001) contains the upstream vendor fix introduced in commit 3d028ab2ca7 by Joakim Erdfelt. The fix adds a getFileName() method that extracts only the last path segment instead of the full path. This fix was already present in upstream Jetty..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:36:00.108725+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 (information disclosure via DefaultHandler 404 error page) is NOT present in target version 10.0.31. The vulnerability was fixed upstream in April 2019 (commit 04c994712c0) and included in all Jetty 10.x releases. TuxCare onboarded version 10.0.26 in December 2025, which already contained the fix. The vulnerable pattern (outputting context.toString() in error HTML) has been verif...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 (information disclosure via DefaultHandler 404 error page) is NOT present in target version 10.0.31. The vulnerability was fixed upstream in April 2019 (commit 04c994712c0) and included in all Jetty 10.x releases. TuxCare onboarded version 10.0.26 in December 2025, which already contained the fix. The vulnerable pattern (outputting context.toString() in error HTML) has been verif..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:17:00.498992+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 10.0.31.tuxcare0001) is NOT AFFECTED by CVE-2019-17632. The vulnerability pattern (unescaped exception messages in error responses) is not present because the upstream vendor fix was already included in the Jetty release that TuxCare onboarded. The fix commits (9e40fc9a6fb and cf0df6e3ffd) by Joakim Erdfelt sanitize all exception messages and stacktrace output using...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 10.0.31.tuxcare0001) is NOT AFFECTED by CVE-2019-17632. The vulnerability pattern (unescaped exception messages in error responses) is not present because the upstream vendor fix was already included in the Jetty release that TuxCare onboarded. The fix commits (9e40fc9a6fb and cf0df6e3ffd) by Joakim Erdfelt sanitize all exception messages and stacktrace output using..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Target Jetty 10.0.31.tuxcare0001 is not affected by CVE-2019-17638. The vulnerability (double-release of ByteBuffer causing response data leakage between clients) was fixed by upstream in commit ff8ae56fa93 by Greg Wilkins. This fix was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded, well before the 10.0.31 target version. The vulnerable pattern (releasing buffer before capacity check, allowing exception-triggered double-release) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "Target Jetty 10.0.31.tuxcare0001 is not affected by CVE-2019-17638. The vulnerability (double-release of ByteBuffer causing response data leakage between clients) was fixed by upstream in commit ff8ae56fa93 by Greg Wilkins. This fix was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded, well before the 10.0.31 target version. The vulnerable pattern (releasing buffer before capacity check, allowing exception-triggered double-release) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:37:00.885618+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 10.0.31 is NOT affected by CVE-2020-27218. The vulnerability fix was shipped in upstream Jetty 10.0.0 (November 2020) and was already present when TuxCare onboarded version 10.0.26. The fix includes the `ensureConsumeAllOrNotPersistent()` method that consumes raw network bytes (without gzip decompression) and adds `Connection: close` when consumption would block, preventing uncon...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 Target version 10.0.31 is NOT affected by CVE-2020-27218. The vulnerability fix was shipped in upstream Jetty 10.0.0 (November 2020) and was already present when TuxCare onboarded version 10.0.26. The fix includes the `ensureConsumeAllOrNotPersistent()` method that consumes raw network bytes (without gzip decompression) and adds `Connection: close` when consumption would block, preventing uncon..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:30:02.504031+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223 affects Jetty's QuotedQualityCSV class, which used an inefficient O(n\u00b2) bubble-sort algorithm causing CPU exhaustion DoS when processing HTTP headers with many quality parameters. The target repository (Jetty 10.0.31.tuxcare0001) contains the FIXED version using O(n log n) comparator-based sorting with a QualityValue inner class. The fix (commit 10e531756b9) was authored by upstr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27223 affects Jetty's QuotedQualityCSV class, which used an inefficient O(n\u00b2) bubble-sort algorithm causing CPU exhaustion DoS when processing HTTP headers with many quality parameters. The target repository (Jetty 10.0.31.tuxcare0001) contains the FIXED version using O(n log n) comparator-based sorting with a QualityValue inner class. The fix (commit 10e531756b9) was authored by upstr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:27:39.447287+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. The target repository (Jetty 10.0.31) is NOT affected by CVE-2021-28165. The vulnerability involved an infinite loop causing 100% CPU usage when processing oversized TLS frames (>17408 bytes). The upstream fix (commit 039c7386d0f) adds validation that throws SSLHandshakeException when the encrypted input buffer is full, preventing the infinite loop. This fix was already present in the upstream release 10.0.26+ that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (838cbf77196 \"setup 10.0.26\"). The defense code is at jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java lines 756-760.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "The target repository (Jetty 10.0.31) is NOT affected by CVE-2021-28165. The vulnerability involved an infinite loop causing 100% CPU usage when processing oversized TLS frames (>17408 bytes). The upstream fix (commit 039c7386d0f) adds validation that throws SSLHandshakeException when the encrypted input buffer is full, preventing the infinite loop. This fix was already present in the upstream release 10.0.26+ that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (838cbf77196 \"setup 10.0.26\"). The defense code is at jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java lines 756-760.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (jetty-project 10.0.31) contains the upstream vendor fix for CVE-2021-34428. The vulnerability pattern has been removed by commit 087f486b446 authored by Jan Bartel from the Eclipse Jetty project. The fix ensures session IDs are invalidated even when SessionListener#sessionDestroyed() throws exceptions by moving the invalidateAll() call into a finally block. This is not a ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 The target repository (jetty-project 10.0.31) contains the upstream vendor fix for CVE-2021-34428. The vulnerability pattern has been removed by commit 087f486b446 authored by Jan Bartel from the Eclipse Jetty project. The fix ensures session IDs are invalidated even when SessionListener#sessionDestroyed() throws exceptions by moving the invalidateAll() call into a finally block. This is not a ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2022-2191 does not affect this target. The vulnerability (ByteBuffer memory leak in SslConnection error paths) was fixed in upstream Jetty 10.0.10 via commit 66de7ba6180e4 (June 2022) by Ludovic Orban. The target version 10.0.31 includes this upstream fix - all defensive methods (discardInputBuffers, discardEncryptedOutputBuffer) are present and correctly invoked in error handlers for fill(), flush(), doClose(), and disconnect(). This fix shipped in the upstream release before TuxCare onboarded version 10.0.26.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "CVE-2022-2191 does not affect this target. The vulnerability (ByteBuffer memory leak in SslConnection error paths) was fixed in upstream Jetty 10.0.10 via commit 66de7ba6180e4 (June 2022) by Ludovic Orban. The target version 10.0.31 includes this upstream fix - all defensive methods (discardInputBuffers, discardEncryptedOutputBuffer) are present and correctly invoked in error handlers for fill(), flush(), doClose(), and disconnect(). This fix shipped in the upstream release before TuxCare onboarded version 10.0.26.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:45:00.091067+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26048 is not present in Jetty 10.0.31. Both required defenses from the upstream patch are present and enabled by default: (1) part count limit (DEFAULT_MAX_FORM_KEYS=1000) enforced at MultiPartFormInputStream.java:816-818, and (2) cumulative form content size limit (DEFAULT_MAX_FORM_CONTENT_SIZE=200KB) enforced at Request.java:2406-2408. The fix was authored by Lachlan Roberts (lachlan...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26048 is not present in Jetty 10.0.31. Both required defenses from the upstream patch are present and enabled by default: (1) part count limit (DEFAULT_MAX_FORM_KEYS=1000) enforced at MultiPartFormInputStream.java:816-818, and (2) cumulative form content size limit (DEFAULT_MAX_FORM_CONTENT_SIZE=200KB) enforced at Request.java:2406-2408. The fix was authored by Lachlan Roberts (lachlan..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:17:00.108725+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 does not affect Jetty 10.0.31. The vulnerability involves nonstandard cookie parsing that allows semicolons inside quoted cookie values to be treated as part of the value rather than as cookie separators, enabling cookie smuggling attacks. The upstream fix (commit 7b8c2c1bf08) introduced RFC6265CookieParser which properly rejects cookies containing semicolons inside quoted values...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 does not affect Jetty 10.0.31. The vulnerability involves nonstandard cookie parsing that allows semicolons inside quoted cookie values to be treated as part of the value rather than as cookie separators, enabling cookie smuggling attacks. The upstream fix (commit 7b8c2c1bf08) introduced RFC6265CookieParser which properly rejects cookies containing semicolons inside quoted values..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2024-13009 affects Jetty 9.4.0-9.4.56 due to improper buffer release on gzip decompression errors, allowing data leakage between requests. The target version 10.0.31 is NOT AFFECTED because the upstream fix (commit e3fa9466633 by gregw@webtide.com, Dec 19 2024) was already present in the upstream release before TuxCare onboarded version 10.0.26 (setup commit 838cbf7719 on Jun 2026). The vulnerable buffer-reuse pattern does not exist in version 10.0.31; defensive code properly nulls content references on failure.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "CVE-2024-13009 affects Jetty 9.4.0-9.4.56 due to improper buffer release on gzip decompression errors, allowing data leakage between requests. The target version 10.0.31 is NOT AFFECTED because the upstream fix (commit e3fa9466633 by gregw@webtide.com, Dec 19 2024) was already present in the upstream release before TuxCare onboarded version 10.0.26 (setup commit 838cbf7719 on Jun 2026). The vulnerable buffer-reuse pattern does not exist in version 10.0.31; defensive code properly nulls content references on failure.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. The target Jetty 10.0.31 is not affected by CVE-2024-7708. The vulnerability (memory leak when handling HTTP requests with bodies that may return 0 bytes on read) was fixed in upstream Jetty 10.0.23 by commit 8259eabbc70. TuxCare onboarded version 10.0.26, which already contained this upstream fix. The target code at HttpConnection.java:381-386 correctly releases request buffers when fill operations return 0 or negative bytes, and lines 398-402 handle exception cases. The vulnerable pattern (unreleased buffers accumulating) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "The target Jetty 10.0.31 is not affected by CVE-2024-7708. The vulnerability (memory leak when handling HTTP requests with bodies that may return 0 bytes on read) was fixed in upstream Jetty 10.0.23 by commit 8259eabbc70. TuxCare onboarded version 10.0.26, which already contained this upstream fix. The target code at HttpConnection.java:381-386 correctly releases request buffers when fill operations return 0 or negative bytes, and lines 398-402 handle exception cases. The vulnerable pattern (unreleased buffers accumulating) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2026-10051 describes a trailer leak vulnerability in Jetty 12.x where connection-scoped _trailers field is never reset between HTTP/1.1 keep-alive requests. The target (Jetty 10.0.31) uses a different architecture where _trailers resides in HttpChannelOverHttp and is properly reset via recycle() method, which is called between every request. This defensive code has been present since traile...",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-10051 describes a trailer leak vulnerability in Jetty 12.x where connection-scoped _trailers field is never reset between HTTP/1.1 keep-alive requests. The target (Jetty 10.0.31) uses a different architecture where _trailers resides in HttpChannelOverHttp and is properly reset via recycle() method, which is called between every request. This defensive code has been present since traile..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    }
  ]
}