{
  "@id": "urn:uuid:03866079-a86e-461c-8d68-234ce7cd9ca5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:47:26.501853+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:08:44.196020+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 affects Jetty versions before 6.1.0pre3 (from 2006) due to predictable session ID generation using java.util.Random. The target repository is Jetty 10.0.32.tuxcare0001, many major versions beyond the affected range. The vulnerable pattern (using only java.util.Random for session IDs) is not present. Instead, DefaultSessionIdManager.initRandom() uses SecureRandom by default (line 3...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 affects Jetty versions before 6.1.0pre3 (from 2006) due to predictable session ID generation using java.util.Random. The target repository is Jetty 10.0.32.tuxcare0001, many major versions beyond the affected range. The vulnerable pattern (using only java.util.Random for session IDs) is not present. Instead, DefaultSessionIdManager.initRandom() uses SecureRandom by default (line 3..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target is NOT AFFECTED. CVE-2011-4461 describes hash collision DOS via unbounded form parameter count. The upstream Jetty project fixed this in commit 085c79d7d6c (Dec 2011) by adding maxFormKeys limit (default 1000). This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded. The defense is complete: ContextHandler defines DEFAULT_MAX_FORM_KEYS=1000, Request.extr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 Target is NOT AFFECTED. CVE-2011-4461 describes hash collision DOS via unbounded form parameter count. The upstream Jetty project fixed this in commit 085c79d7d6c (Dec 2011) by adding maxFormKeys limit (default 1000). This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded. The defense is complete: ContextHandler defines DEFAULT_MAX_FORM_KEYS=1000, Request.extr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T17:47:26.501853+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.32 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 10.0.32 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:30:53.892571+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.0 through 9.3.8 (path normalization bypass on Windows via escaped backslashes). The target is Jetty 10.0.32.tuxcare0001. The upstream fix (commit 97af3d663fd by Joakim Erdfelt, May 2016) was already present in Jetty 10.0.26 that TuxCare onboarded. The fix enhances PathResource.checkAliasPath() to detect when URI encoding differs from filesystem path norma...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.0 through 9.3.8 (path normalization bypass on Windows via escaped backslashes). The target is Jetty 10.0.32.tuxcare0001. The upstream fix (commit 97af3d663fd by Joakim Erdfelt, May 2016) was already present in Jetty 10.0.26 that TuxCare onboarded. The fix enhances PathResource.checkAliasPath() to detect when URI encoding differs from filesystem path norma..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:44:25.010068+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. The target (Jetty 10.0.32.tuxcare0001) is NOT AFFECTED by CVE-2017-7656. The upstream vendor (Eclipse Jetty) fixed this HTTP Request Smuggling vulnerability in commit a285deea (May 2018) by adding validation that rejects requests with conflicting message framing headers (multiple Content-Length or Content-Length + Transfer-Encoding: chunked). This fix was already present in Jetty 10.0.26, the upstream release that TuxCare onboarded, and remains active in the current version. The HttpParser enforces RFC7230 compliance by default (no violations allowed), throwing BadMessageException when ambiguous framing is detected. The vulnerable pattern\u2014accepting conflicting framing headers that cause request boundary confusion\u2014is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "The target (Jetty 10.0.32.tuxcare0001) is NOT AFFECTED by CVE-2017-7656. The upstream vendor (Eclipse Jetty) fixed this HTTP Request Smuggling vulnerability in commit a285deea (May 2018) by adding validation that rejects requests with conflicting message framing headers (multiple Content-Length or Content-Length + Transfer-Encoding: chunked). This fix was already present in Jetty 10.0.26, the upstream release that TuxCare onboarded, and remains active in the current version. The HttpParser enforces RFC7230 compliance by default (no violations allowed), throwing BadMessageException when ambiguous framing is detected. The vulnerable pattern\u2014accepting conflicting framing headers that cause request boundary confusion\u2014is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:45:34.333226+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. Target version 10.0.32 is not affected by CVE-2017-7657. While the specific CVE-2017-7657 patch (commit 47bed1aac85) is not present, the target contains an equivalent upstream fix (commit 2ef926811128, \"Backport of #14496\") that was already included in the upstream release when TuxCare onboarded version 10.0.26. This fix protects against integer overflow in chunk length parsing through a 16-digit hexadecimal limit and post-multiplication overflow detection (negative value check). The CVE-2017-7657 test case \"1ff00000008\" would cause overflow to negative during parsing, which is caught by the existing protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "impact_statement": "Target version 10.0.32 is not affected by CVE-2017-7657. While the specific CVE-2017-7657 patch (commit 47bed1aac85) is not present, the target contains an equivalent upstream fix (commit 2ef926811128, \"Backport of #14496\") that was already included in the upstream release when TuxCare onboarded version 10.0.26. This fix protects against integer overflow in chunk length parsing through a 16-digit hexadecimal limit and post-multiplication overflow detection (negative value check). The CVE-2017-7657 test case \"1ff00000008\" would cause overflow to negative during parsing, which is caught by the existing protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:21:26.071673+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. Target version 10.0.32 is not affected by CVE-2017-7658 (HTTP request smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked). The vulnerability was fixed by upstream Jetty commit a285deea42f (Greg Wilkins, May 17 2018) which added `_hasContentLength` tracking and validation logic to reject both attack patterns. This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded in December 2025. The default compliance mode RFC7230 enforces these checks by throwing BadMessageException when violations are detected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "Target version 10.0.32 is not affected by CVE-2017-7658 (HTTP request smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked). The vulnerability was fixed by upstream Jetty commit a285deea42f (Greg Wilkins, May 17 2018) which added `_hasContentLength` tracking and validation logic to reject both attack patterns. This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded in December 2025. The default compliance mode RFC7230 enforces these checks by throwing BadMessageException when violations are detected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:33:19.742472+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. The target repository (Jetty 10.0.32) is not affected by CVE-2017-9735, a timing channel vulnerability in password comparison. The fix implementing constant-time string comparison via `stringEquals()` and `byteEquals()` methods was authored by upstream maintainer Simone Bordet (simone.bordet@gmail.com) in commit 2baa1abe4b1c380a30deacca1ed367466a1a62ea (May 2017) and shipped in upstream Jetty 10.0.26, which TuxCare onboarded as the foundation for this branch. The vulnerable pattern (early-exit password comparison allowing timing inference) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "The target repository (Jetty 10.0.32) is not affected by CVE-2017-9735, a timing channel vulnerability in password comparison. The fix implementing constant-time string comparison via `stringEquals()` and `byteEquals()` methods was authored by upstream maintainer Simone Bordet (simone.bordet@gmail.com) in commit 2baa1abe4b1c380a30deacca1ed367466a1a62ea (May 2017) and shipped in upstream Jetty 10.0.26, which TuxCare onboarded as the foundation for this branch. The vulnerable pattern (early-exit password comparison allowing timing inference) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T18:14:00.096888+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 describes an information disclosure vulnerability where invalid path characters trigger java.nio.file.InvalidPathException with full server filesystem paths in error responses. The target repository (Jetty 10.0.32.tuxcare0001) is NOT AFFECTED because the upstream fix (commit 53e8bc2a636, Issue #2560) was already present in the upstream release before TuxCare onboarded version 10....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 describes an information disclosure vulnerability where invalid path characters trigger java.nio.file.InvalidPathException with full server filesystem paths in error responses. The target repository (Jetty 10.0.32.tuxcare0001) is NOT AFFECTED because the upstream fix (commit 53e8bc2a636, Issue #2560) was already present in the upstream release before TuxCare onboarded version 10...."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2018-12545 is NOT present in Jetty 10.0.32. The vulnerability affects unbounded processing of HTTP/2 SETTINGS frames, allowing DoS through excessive memory/CPU consumption. The target contains both required defenses: (1) maxSettingsKeys limit (default 64) in SettingsBodyParser.java:196-197 that rejects frames exceeding the limit, and (2) rate control in SettingsBodyParser.java:223 that prevents frame flooding. Both defenses were added by upstream commits (9eca404da29 for maxSettingsKeys, cfe1baa0482 for RateControl) authored by Simone Bordet and shipped in the upstream Jetty release before TuxCare's onboarding (first TuxCare commit: 760112b4832).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 is NOT present in Jetty 10.0.32. The vulnerability affects unbounded processing of HTTP/2 SETTINGS frames, allowing DoS through excessive memory/CPU consumption. The target contains both required defenses: (1) maxSettingsKeys limit (default 64) in SettingsBodyParser.java:196-197 that rejects frames exceeding the limit, and (2) rate control in SettingsBodyParser.java:223 that prevents frame flooding. Both defenses were added by upstream commits (9eca404da29 for maxSettingsKeys, cfe1baa0482 for RateControl) authored by Simone Bordet and shipped in the upstream Jetty release before TuxCare's onboarding (first TuxCare commit: 760112b4832).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:17:57.385112+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 affects Jetty 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older. The target (Jetty 10.0.32.tuxcare0001) contains the upstream fix committed by joakim.erdfelt@gmail.com in commit 7b774d82e82 (Issue #3549 - Using FileName properly in Directory Listings). This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded via commit 760112b4832. The vuln...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 affects Jetty 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older. The target (Jetty 10.0.32.tuxcare0001) contains the upstream fix committed by joakim.erdfelt@gmail.com in commit 7b774d82e82 (Issue #3549 - Using FileName properly in Directory Listings). This fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded via commit 760112b4832. The vuln..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 10.0.32.tuxcare0001) is NOT affected by CVE-2019-10246. The vulnerability involved directory listings exposing full filesystem paths on Windows. The fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded. The fix, authored by upstream developer Joakim Erdfelt (commits 7b774d82e82 and 3d028ab2ca7), introduced a getFileName() method that ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 10.0.32.tuxcare0001) is NOT affected by CVE-2019-10246. The vulnerability involved directory listings exposing full filesystem paths on Windows. The fix was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded. The fix, authored by upstream developer Joakim Erdfelt (commits 7b774d82e82 and 3d028ab2ca7), introduced a getFileName() method that ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:38:24.044103+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247: Target version 10.0.32 is not affected. The vulnerability (information disclosure via context.toString() in 404 error pages revealing base resource paths) was fixed in upstream Jetty in April 2019 by commits 04c994712c0 and 9f506e4123b, authored by Joakim Erdfelt. These fixes were already present in the upstream release when TuxCare onboarded version 10.0.26 in December 2025. Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247: Target version 10.0.32 is not affected. The vulnerability (information disclosure via context.toString() in 404 error pages revealing base resource paths) was fixed in upstream Jetty in April 2019 by commits 04c994712c0 and 9f506e4123b, authored by Joakim Erdfelt. These fixes were already present in the upstream release when TuxCare onboarded version 10.0.26 in December 2025. Th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:17:00.498992+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 is NOT present in this target. The vulnerability involves unescaped exception messages in HTML/JSON error responses enabling XSS attacks. The upstream fix (commits 9e40fc9a6fb and cf0df6e3ffd by Joakim Erdfelt) was already present in Jetty 10.0.26 before TuxCare began maintaining this version. The fix adds HTML entity escaping via StringUtil.sanitizeXmlString() to all error outpu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 is NOT present in this target. The vulnerability involves unescaped exception messages in HTML/JSON error responses enabling XSS attacks. The upstream fix (commits 9e40fc9a6fb and cf0df6e3ffd by Joakim Erdfelt) was already present in Jetty 10.0.26 before TuxCare began maintaining this version. The fix adds HTML entity escaping via StringUtil.sanitizeXmlString() to all error outpu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. The target repository (Eclipse Jetty 10.0.32.tuxcare0001) is NOT AFFECTED by CVE-2019-17638. The vulnerability involved a double-release of ByteBuffer objects when handling oversized HTTP response headers, allowing response data from one client to leak to another. The upstream vendor fix (commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba, June 3, 2020, authored by gregw@webtide.com) was already present in the upstream release before TuxCare onboarded version 10.0.26. The target code contains the complete fix: proper buffer lifecycle management with releaseHeader() and releaseChunk() methods that null references after release, and HEADER_OVERFLOW handling that checks capacity before releasing buffers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "The target repository (Eclipse Jetty 10.0.32.tuxcare0001) is NOT AFFECTED by CVE-2019-17638. The vulnerability involved a double-release of ByteBuffer objects when handling oversized HTTP response headers, allowing response data from one client to leak to another. The upstream vendor fix (commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba, June 3, 2020, authored by gregw@webtide.com) was already present in the upstream release before TuxCare onboarded version 10.0.26. The target code contains the complete fix: proper buffer lifecycle management with releaseHeader() and releaseChunk() methods that null references after release, and HEADER_OVERFLOW handling that checks capacity before releasing buffers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:37:00.885618+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty 10.0.32 is NOT AFFECTED by CVE-2020-27218. The vulnerability (unconsumed HTTP request body data leaking into subsequent requests on persistent connections) was fixed in upstream commit 14f94f738df (2020-11-18) by Greg Wilkins, which was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded on 2026-08-27. The fix includes: (1) GzipHttpInputInterceptor.failed(...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 10.0.32 is NOT AFFECTED by CVE-2020-27218. The vulnerability (unconsumed HTTP request body data leaking into subsequent requests on persistent connections) was fixed in upstream commit 14f94f738df (2020-11-18) by Greg Wilkins, which was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded on 2026-08-27. The fix includes: (1) GzipHttpInputInterceptor.failed(..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:30:16.565397+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 10.0.32 is NOT AFFECTED by CVE-2020-27223. The vulnerable quadratic/cubic-time bubble sort in QuotedQualityCSV has been replaced with efficient O(n log n) stream-based sorting. This fix was applied by upstream Eclipse Jetty (commit 10e531756b9, author joakim.erdfelt@gmail.com) and was already present in the upstream release when TuxCare onboarded version 10.0.26. The CVE affected...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 Target version 10.0.32 is NOT AFFECTED by CVE-2020-27223. The vulnerable quadratic/cubic-time bubble sort in QuotedQualityCSV has been replaced with efficient O(n log n) stream-based sorting. This fix was applied by upstream Eclipse Jetty (commit 10e531756b9, author joakim.erdfelt@gmail.com) and was already present in the upstream release when TuxCare onboarded version 10.0.26. The CVE affected..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:28:48.622691+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. Target Jetty 10.0.32.tuxcare0001 is NOT affected by CVE-2021-28165. The vulnerability involves oversized TLS frames (>17408 bytes) causing infinite processing loops and CPU exhaustion. The upstream fix (commit 039c7386d0f by Simone Bordet, 2021-03-22) was already present in the Jetty release before TuxCare onboarded this version (first TuxCare commit 3f3b8a62465, 2026-03-30). The target code at jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java lines 756-760 contains the defensive check that detects when the encrypted input buffer is full during BUFFER_UNDERFLOW and throws SSLHandshakeException(\"Encrypted buffer max length exceeded\"), preventing the infinite loop that caused high CPU in vulnerable versions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "Target Jetty 10.0.32.tuxcare0001 is NOT affected by CVE-2021-28165. The vulnerability involves oversized TLS frames (>17408 bytes) causing infinite processing loops and CPU exhaustion. The upstream fix (commit 039c7386d0f by Simone Bordet, 2021-03-22) was already present in the Jetty release before TuxCare onboarded this version (first TuxCare commit 3f3b8a62465, 2026-03-30). The target code at jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java lines 756-760 contains the defensive check that detects when the encrypted input buffer is full during BUFFER_UNDERFLOW and throws SSLHandshakeException(\"Encrypted buffer max length exceeded\"), preventing the infinite loop that caused high CPU in vulnerable versions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 10.0.30 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "Version 10.0.30 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2022-2191 is not present in Jetty 10.0.32.tuxcare0001. The vulnerability (ByteBuffer memory leak in SslConnection error paths) was fixed by upstream commit 66de7ba6180 which was already included in the upstream release before TuxCare onboarded version 10.0.26. The target contains all three critical buffer cleanup methods (discardInputBuffers, discardEncryptedOutputBuffer) properly invoked in exception handlers, preventing the memory leak described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "CVE-2022-2191 is not present in Jetty 10.0.32.tuxcare0001. The vulnerability (ByteBuffer memory leak in SslConnection error paths) was fixed by upstream commit 66de7ba6180 which was already included in the upstream release before TuxCare onboarded version 10.0.26. The target contains all three critical buffer cleanup methods (discardInputBuffers, discardEncryptedOutputBuffer) properly invoked in exception handlers, preventing the memory leak described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:45:00.091067+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26048 is NOT present in Jetty 10.0.32. The upstream fix (PR #9344, commit 622befbd) was released in Jetty 10.0.14 (February 2023) and is already in the target version 10.0.32. Both required defenses are present and active by default: (1) part count limit (_maxParts = 1000), and (2) cumulative content size limit for non-file parts (maxFormContentSize = 200KB). The fix author is lachlan@...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26048 is NOT present in Jetty 10.0.32. The upstream fix (PR #9344, commit 622befbd) was released in Jetty 10.0.14 (February 2023) and is already in the target version 10.0.32. Both required defenses are present and active by default: (1) part count limit (_maxParts = 1000), and (2) cumulative content size limit for non-file parts (maxFormContentSize = 200KB). The fix author is lachlan@..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:16:00.096279+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 10.0.32 is not affected by CVE-2023-26049. The upstream Eclipse Jetty project fixed this cookie smuggling vulnerability in commit 7b8c2c1bf08 (authored by Simone Bordet, Feb 14 2023) before TuxCare onboarded version 10.0.26. The fix adds rejection of semicolons in quoted cookie values via isRFC6265RejectedCharacter method, which is enabled by default in RFC6265 compliance mode. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 Target version 10.0.32 is not affected by CVE-2023-26049. The upstream Eclipse Jetty project fixed this cookie smuggling vulnerability in commit 7b8c2c1bf08 (authored by Simone Bordet, Feb 14 2023) before TuxCare onboarded version 10.0.26. The fix adds rejection of semicolons in quoted cookie values via isRFC6265RejectedCharacter method, which is enabled by default in RFC6265 compliance mode. T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2024-13009 affects Jetty 9.4.0-9.4.56 due to improper buffer release on gzip inflation errors, causing buffer reuse/sharing between requests. The target version 10.0.32 uses a refactored ContentProducer architecture introduced in Jetty 10.x. The upstream fix (commit 25467f89043 \"Improve handling of HttpInput.Interceptor behavior\" by Ludovic Orban, April 15, 2021) was already present in the 10.0.26 release that TuxCare onboarded (December 12, 2025). The fix ensures AsyncContentProducer.failCurrentContent() properly nullifies _rawContent and _transformedContent on interceptor errors, preventing buffer reuse. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "CVE-2024-13009 affects Jetty 9.4.0-9.4.56 due to improper buffer release on gzip inflation errors, causing buffer reuse/sharing between requests. The target version 10.0.32 uses a refactored ContentProducer architecture introduced in Jetty 10.x. The upstream fix (commit 25467f89043 \"Improve handling of HttpInput.Interceptor behavior\" by Ludovic Orban, April 15, 2021) was already present in the 10.0.26 release that TuxCare onboarded (December 12, 2025). The fix ensures AsyncContentProducer.failCurrentContent() properly nullifies _rawContent and _transformedContent on interceptor errors, preventing buffer reuse. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2024-7708 is NOT present in target Jetty 10.0.32. The vulnerability (memory leak when HTTP request body read returns 0 bytes) was fixed in upstream Jetty 10.0.23 by commit 8259eabbc70 (Aug 2024). This upstream fix was already present in the base release (10.0.26) that TuxCare onboarded. Verification shows HttpConnection.java contains the fix: releaseRequestBuffer() is called when fillRequestBuffer() returns \u22640 bytes (line 385) and in exception handler (line 401), preventing buffer leaks. Target version 10.0.32 inherits this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "CVE-2024-7708 is NOT present in target Jetty 10.0.32. The vulnerability (memory leak when HTTP request body read returns 0 bytes) was fixed in upstream Jetty 10.0.23 by commit 8259eabbc70 (Aug 2024). This upstream fix was already present in the base release (10.0.26) that TuxCare onboarded. Verification shows HttpConnection.java contains the fix: releaseRequestBuffer() is called when fillRequestBuffer() returns \u22640 bytes (line 385) and in exception handler (line 401), preventing buffer leaks. Target version 10.0.32 inherits this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 10.0.30 is not affected by CVE-2026-10051. The CVE targets Jetty 12+ jetty-core architecture (jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/HttpConnection.java), which does not exist in Jetty 10. While Jetty 10 uses a different architecture (HttpChannelOverHttp.java) that processes HTTP trailers, it has an effective defense: the _trailers field is nulled in the r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 10.0.30 is not affected by CVE-2026-10051. The CVE targets Jetty 12+ jetty-core architecture (jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/HttpConnection.java), which does not exist in Jetty 10. While Jetty 10 uses a different architecture (HttpChannelOverHttp.java) that processes HTTP trailers, it has an effective defense: the _trailers field is nulled in the r..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    }
  ]
}