{
  "@id": "urn:uuid:2f0b3001-3ff8-4682-af2c-5f495c2c4061",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 40,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:45:44.119017+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:04:56.336983+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 affects Jetty versions before 6.1.0pre3 (November 2006) that used predictable java.util.Random for session ID generation. The target is Jetty 11.0.19 (December 2023), which uses java.security.SecureRandom by default for cryptographically secure session IDs. The vulnerable pattern (using only java.util.Random) is not present in this version. The fix was applied in upstream Jetty 6....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 affects Jetty versions before 6.1.0pre3 (November 2006) that used predictable java.util.Random for session ID generation. The target is Jetty 11.0.19 (December 2023), which uses java.security.SecureRandom by default for cryptographically secure session IDs. The vulnerable pattern (using only java.util.Random) is not present in this version. The fix was applied in upstream Jetty 6...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 (hash collision DoS) is NOT present in Jetty 11.0.19. The fix limiting form parameter keys (maxFormKeys, default 1000) was already present in the upstream Jetty 11.0.19 release that TuxCare onboarded. The vulnerable pattern (unbounded form parameter processing allowing hash collision attacks) does not exist in the target. Defense commit 085c79d7d6cfbccc02821ffdb64968593df3e0bf by ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-4461 (hash collision DoS) is NOT present in Jetty 11.0.19. The fix limiting form parameter keys (maxFormKeys, default 1000) was already present in the upstream Jetty 11.0.19 release that TuxCare onboarded. The vulnerable pattern (unbounded form parameter processing allowing hash collision attacks) does not exist in the target. Defense commit 085c79d7d6cfbccc02821ffdb64968593df3e0bf by ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T17:45:44.119017+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 11.0.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 11.0.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:26:10.977883+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Jetty 9.3.x before 9.3.9 and involves path normalization vulnerabilities on Windows allowing backslash-based bypasses of protected resource restrictions. The target version 11.0.19 is NOT AFFECTED because the upstream fix (commit 97af3d663fd from May 2016) was already present in the Jetty 11.0.19 release that TuxCare onboarded. The fix adds URI comparison checks in PathRes...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Jetty 9.3.x before 9.3.9 and involves path normalization vulnerabilities on Windows allowing backslash-based bypasses of protected resource restrictions. The target version 11.0.19 is NOT AFFECTED because the upstream fix (commit 97af3d663fd from May 2016) was already present in the Jetty 11.0.19 release that TuxCare onboarded. The fix adds URI comparison checks in PathRes..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:37:57.932432+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. Jetty 11.0.19 ships with upstream fix commit a285deea42f that addresses CVE-2017-7656. The fix introduces multiple defenses against HTTP request smuggling: (1) rejects multiple Content-Length headers via _hasContentLength flag, (2) rejects simultaneous Transfer-Encoding and Content-Length headers, (3) validates chunk length against MAX_CHUNK_LENGTH, and (4) uses RFC7230 compliance mode by default which disallows these violations. The vulnerable pattern is not present in the default configuration. The fix was authored by Greg Wilkins (gregw@webtide.com) and shipped in the upstream Jetty 11.0.19 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "Jetty 11.0.19 ships with upstream fix commit a285deea42f that addresses CVE-2017-7656. The fix introduces multiple defenses against HTTP request smuggling: (1) rejects multiple Content-Length headers via _hasContentLength flag, (2) rejects simultaneous Transfer-Encoding and Content-Length headers, (3) validates chunk length against MAX_CHUNK_LENGTH, and (4) uses RFC7230 compliance mode by default which disallows these violations. The vulnerable pattern is not present in the default configuration. The fix was authored by Greg Wilkins (gregw@webtide.com) and shipped in the upstream Jetty 11.0.19 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. CVE-2017-7658 is not present in jetty-project 11.0.19. The vulnerability (HTTP request smuggling via multiple Content-Length headers or both Content-Length and Transfer-Encoding: chunked) was fixed in upstream commit a285deea by Greg Wilkins (Webtide/Eclipse) in May 2018. This fix was included in the upstream 11.0.19 release (December 2023) that TuxCare onboarded. The target code in HttpParser.java correctly rejects ambiguous content-length headers by throwing BadMessageException with HTTP 400 status in the default RFC7230 compliance mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "CVE-2017-7658 is not present in jetty-project 11.0.19. The vulnerability (HTTP request smuggling via multiple Content-Length headers or both Content-Length and Transfer-Encoding: chunked) was fixed in upstream commit a285deea by Greg Wilkins (Webtide/Eclipse) in May 2018. This fix was included in the upstream 11.0.19 release (December 2023) that TuxCare onboarded. The target code in HttpParser.java correctly rejects ambiguous content-length headers by throwing BadMessageException with HTTP 400 status in the default RFC7230 compliance mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:26:45.505192+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. CVE-2017-9735 is NOT present in Jetty 11.0.19-tuxcare.4. The timing channel vulnerability in password comparison was fixed in upstream commit 042f325f1cd (May 2017) by introducing constant-time stringEquals() and byteEquals() methods. This fix was already included in the upstream Jetty 11.0.19 release before TuxCare onboarded it (first TuxCare commit: 01d1fa7766d \"setup 11.0.19\"). All password/credential comparison operations in Password.java, Credential.java (Crypt, MD5 classes), and authentication modules correctly use the constant-time methods instead of variable-time String.equals() or Arrays.equals().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 is NOT present in Jetty 11.0.19-tuxcare.4. The timing channel vulnerability in password comparison was fixed in upstream commit 042f325f1cd (May 2017) by introducing constant-time stringEquals() and byteEquals() methods. This fix was already included in the upstream Jetty 11.0.19 release before TuxCare onboarded it (first TuxCare commit: 01d1fa7766d \"setup 11.0.19\"). All password/credential comparison operations in Password.java, Credential.java (Crypt, MD5 classes), and authentication modules correctly use the constant-time methods instead of variable-time String.equals() or Arrays.equals().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T17:57:00.090611+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.19) is NOT affected by CVE-2018-12536. The vulnerability involved path disclosure through unhandled InvalidPathException messages when bad characters in HTTP request paths triggered filesystem exceptions. The fix was already present in the upstream Jetty 11.0.19 release that TuxCare onboarded. Upstream commit ad4dceb1c08679baa2a6a64356fcde5309e13fd8 (May 31, 20...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.19) is NOT affected by CVE-2018-12536. The vulnerability involved path disclosure through unhandled InvalidPathException messages when bad characters in HTTP request paths triggered filesystem exceptions. The fix was already present in the upstream Jetty 11.0.19 release that TuxCare onboarded. Upstream commit ad4dceb1c08679baa2a6a64356fcde5309e13fd8 (May 31, 20..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. The target repository (Jetty 11.0.19) is NOT AFFECTED by CVE-2018-12545. The vulnerability was fixed in upstream commit 9eca404da29 (July 2018) which added maxSettingsKeys limit (DEFAULT_MAX_KEYS=64) and rate control mechanisms to prevent DoS via large/many SETTINGS frames. This fix was already present in the upstream Jetty 11.0.19 release that TuxCare onboarded (first TuxCare commit 01d1fa7). The defense code is active by default: SettingsBodyParser enforces a 64-key limit per frame, and WindowRateControl limits frame rate to 128 events/second, both returning ENHANCE_YOUR_CALM_ERROR when limits are exceeded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "The target repository (Jetty 11.0.19) is NOT AFFECTED by CVE-2018-12545. The vulnerability was fixed in upstream commit 9eca404da29 (July 2018) which added maxSettingsKeys limit (DEFAULT_MAX_KEYS=64) and rate control mechanisms to prevent DoS via large/many SETTINGS frames. This fix was already present in the upstream Jetty 11.0.19 release that TuxCare onboarded (first TuxCare commit 01d1fa7). The defense code is active by default: SettingsBodyParser enforces a 64-key limit per frame, and WindowRateControl limits frame rate to 128 events/second, both returning ENHANCE_YOUR_CALM_ERROR when limits are exceeded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T15:59:37.450285+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 is an XSS vulnerability in Jetty's directory listing feature where specially formatted URLs could cause unescaped special characters or full filesystem paths to be rendered in HTML output. The upstream fix (commit 7b774d82e82 by Joakim Erdfelt, April 2019) introduced the getFileName() method that extracts only the filename segment and URL-decodes it properly. This fix was already...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 is an XSS vulnerability in Jetty's directory listing feature where specially formatted URLs could cause unescaped special characters or full filesystem paths to be rendered in HTML output. The upstream fix (commit 7b774d82e82 by Joakim Erdfelt, April 2019) introduced the getFileName() method that extracts only the filename segment and URL-decodes it properly. This fix was already..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 (directory listing path disclosure on Windows) is not present in the target. The vulnerability was fixed upstream by Jetty maintainer Joakim Erdfelt in April 2019 (commit 3d028ab2ca7). This fix was already included in Jetty 11.0.19 when TuxCare onboarded the release in January 2026. The target uses the safe getFileName() method which extracts only the filename, preventing full fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 (directory listing path disclosure on Windows) is not present in the target. The vulnerability was fixed upstream by Jetty maintainer Joakim Erdfelt in April 2019 (commit 3d028ab2ca7). This fix was already included in Jetty 11.0.19 when TuxCare onboarded the release in January 2026. The target uses the safe getFileName() method which extracts only the filename, preventing full fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T16:22:37.986453+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 is not present in Jetty 11.0.19. The vulnerability involved DefaultHandler revealing filesystem paths via context.toString() in 404 error pages. The fix (commit 04c99471 from April 2019) was already included in upstream Jetty 11.0.19 when TuxCare onboarded it in January 2026. Current DefaultHandler code (lines 142-182) outputs only safe context information (path, display name, st...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 is not present in Jetty 11.0.19. The vulnerability involved DefaultHandler revealing filesystem paths via context.toString() in 404 error pages. The fix (commit 04c99471 from April 2019) was already included in upstream Jetty 11.0.19 when TuxCare onboarded it in January 2026. Current DefaultHandler code (lines 142-182) outputs only safe context information (path, display name, st..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T19:14:00.100615+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.19) is not affected by CVE-2019-17632. The vulnerability fix was already present in the upstream release 11.0.19 before TuxCare onboarded the code. The fix commits (cf0df6e3ffd and 9e40fc9a6fb) by Joakim Erdfelt introduce proper sanitization of exception messages and stack traces in error responses, preventing XSS attacks through unescaped HTML/script content i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.19) is not affected by CVE-2019-17632. The vulnerability fix was already present in the upstream release 11.0.19 before TuxCare onboarded the code. The fix commits (cf0df6e3ffd and 9e40fc9a6fb) by Joakim Erdfelt introduce proper sanitization of exception messages and stack traces in error responses, preventing XSS attacks through unescaped HTML/script content i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. CVE-2019-17638 (ByteBuffer double-release leading to response data leakage) is NOT present in Jetty 11.0.19. The upstream fix (commit ff8ae56fa93, June 2020) that adds releaseHeader() and releaseChunk() helper methods to atomically release and null buffers was already included in the upstream Jetty 11.0.19 release before TuxCare onboarding. The vulnerable pattern (releasing buffers without nulling, then releasing again on exception) does not exist in the current code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "CVE-2019-17638 (ByteBuffer double-release leading to response data leakage) is NOT present in Jetty 11.0.19. The upstream fix (commit ff8ae56fa93, June 2020) that adds releaseHeader() and releaseChunk() helper methods to atomically release and null buffers was already included in the upstream Jetty 11.0.19 release before TuxCare onboarding. The vulnerable pattern (releasing buffers without nulling, then releasing again on exception) does not exist in the current code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T19:32:24.305255+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 11.0.19-tuxcare.4 is NOT AFFECTED by CVE-2020-27218 (GZIP request body pollution vulnerability). The fix for Issue #5605 was already present in the upstream Jetty 11.0.19 release that TuxCare onboarded. Fix commit 14f94f738df authored by gregw@webtide.com (upstream) is on HEAD and was IN_UPSTREAM_RELEASE. The defense mechanisms (GzipHttpInputInterceptor.failed(), Response.sendR...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 11.0.19-tuxcare.4 is NOT AFFECTED by CVE-2020-27218 (GZIP request body pollution vulnerability). The fix for Issue #5605 was already present in the upstream Jetty 11.0.19 release that TuxCare onboarded. Fix commit 14f94f738df authored by gregw@webtide.com (upstream) is on HEAD and was IN_UPSTREAM_RELEASE. The defense mechanisms (GzipHttpInputInterceptor.failed(), Response.sendR..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T19:25:54.752910+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223: The target repository (jetty-project 11.0.19-tuxcare.4) is NOT AFFECTED. The vulnerability was fixed in upstream Jetty 11.0.1 (released February 2021) by replacing the inefficient O(n\u00b2) bubble-sort algorithm in QuotedQualityCSV with O(n log n) comparator-based sorting. The fix commit (10e531756b9) was already present in the upstream 11.0.19 release before TuxCare onboarded it in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27223: The target repository (jetty-project 11.0.19-tuxcare.4) is NOT AFFECTED. The vulnerability was fixed in upstream Jetty 11.0.1 (released February 2021) by replacing the inefficient O(n\u00b2) bubble-sort algorithm in QuotedQualityCSV with O(n log n) comparator-based sorting. The fix commit (10e531756b9) was already present in the upstream 11.0.19 release before TuxCare onboarded it in..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:22:29.685630+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. The target Jetty 11.0.19 is NOT AFFECTED by CVE-2021-28165. The vulnerability (infinite CPU loop when processing oversized TLS frames >17408 bytes) was fixed by upstream commit 039c7386d0f, which shipped in the upstream Jetty 11.0.19 release before TuxCare onboarding. The fix is present in SslConnection.java at lines 756-760, where the code checks if the encrypted input buffer is full (BufferUtil.space == 0) and throws SSLHandshakeException before attempting further processing, preventing the infinite loop that caused CPU exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "The target Jetty 11.0.19 is NOT AFFECTED by CVE-2021-28165. The vulnerability (infinite CPU loop when processing oversized TLS frames >17408 bytes) was fixed by upstream commit 039c7386d0f, which shipped in the upstream Jetty 11.0.19 release before TuxCare onboarding. The fix is present in SslConnection.java at lines 756-760, where the code checks if the encrypted input buffer is full (BufferUtil.space == 0) and throws SSLHandshakeException before attempting further processing, preventing the infinite loop that caused CPU exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T15:16:00.096279+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2021-34428 is not present in Jetty 11.0.19. The vulnerability concerns session ID invalidation failure when SessionListener.sessionDestroyed() throws an exception. The upstream fix (commit cd6462a6252 by Jan Bartel, dated May 16, 2021) was already included in the Jetty 11.0.19 release that TuxCare onboarded. The fix wraps callSessionDestroyedListeners() in try-catch and moves invalidateAll(...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34428 is not present in Jetty 11.0.19. The vulnerability concerns session ID invalidation failure when SessionListener.sessionDestroyed() throws an exception. The upstream fix (commit cd6462a6252 by Jan Bartel, dated May 16, 2021) was already included in the Jetty 11.0.19 release that TuxCare onboarded. The fix wraps callSessionDestroyedListeners() in try-catch and moves invalidateAll(..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. CVE-2022-2191 is NOT present in Jetty 11.0.19. The vulnerability (SslConnection not releasing ByteBuffers in error code paths) was fixed in upstream commit 66de7ba6180 by Ludovic Orban, which was already included in the upstream Jetty 11.0.19 release. The target repository contains all defensive mechanisms from the fix: discardInputBuffers() and discardEncryptedOutputBuffer() methods properly invoked in all exception handlers. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "CVE-2022-2191 is NOT present in Jetty 11.0.19. The vulnerability (SslConnection not releasing ByteBuffers in error code paths) was fixed in upstream commit 66de7ba6180 by Ludovic Orban, which was already included in the upstream Jetty 11.0.19 release. The target repository contains all defensive mechanisms from the fix: discardInputBuffers() and discardEncryptedOutputBuffer() methods properly invoked in all exception handlers. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T15:32:58.011211+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26048 (multipart OOM vulnerability) is not present in target Jetty 11.0.19-tuxcare.4. The fix was already included in the upstream Jetty 11.0.19 release that TuxCare onboarded. Both protective mechanisms are present and active by default: (1) part count limited to 1000 via _maxParts check in MultiPartFormInputStream.java:816-818 and MultiPartInputStreamParser.java:694-696; (2) form fie...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26048 (multipart OOM vulnerability) is not present in target Jetty 11.0.19-tuxcare.4. The fix was already included in the upstream Jetty 11.0.19 release that TuxCare onboarded. Both protective mechanisms are present and active by default: (1) part count limited to 1000 via _maxParts check in MultiPartFormInputStream.java:816-818 and MultiPartInputStreamParser.java:694-696; (2) form fie..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T15:05:37.424044+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 11.0.19 is NOT AFFECTED by CVE-2023-26049. The vulnerability (nonstandard cookie parsing that accepts semicolons inside quoted cookie values, enabling cookie smuggling) was fixed in upstream Jetty commit 7b8c2c1bf08 (Feb 2023) by introducing RFC6265CookieParser with strict quoted-value validation. This fix was already present in the upstream Jetty 11.0.19 release before TuxCare o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 Target version 11.0.19 is NOT AFFECTED by CVE-2023-26049. The vulnerability (nonstandard cookie parsing that accepts semicolons inside quoted cookie values, enabling cookie smuggling) was fixed in upstream Jetty commit 7b8c2c1bf08 (Feb 2023) by introducing RFC6265CookieParser with strict quoted-value validation. This fix was already present in the upstream Jetty 11.0.19 release before TuxCare o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. Target Jetty 11.0.19-tuxcare.4 is not affected by CVE-2024-13009. The vulnerability affects Jetty 9.4.0-9.4.56 where gzip decompression errors left content buffers non-nullified, enabling cross-request data leakage. Jetty 11 uses a different ContentProducer architecture where AsyncContentProducer.failCurrentContent() automatically nullifies buffers on any interception exception. This protection was part of the original ContentProducer design from March 2020 (commit 814dc69803f), predating CVE discovery by 4+ years. The upstream fix e3fa9466633 targets 9.4.57-SNAPSHOT and is not on the 11.0.19 branch because Jetty 11's architecture inherently prevents this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "Target Jetty 11.0.19-tuxcare.4 is not affected by CVE-2024-13009. The vulnerability affects Jetty 9.4.0-9.4.56 where gzip decompression errors left content buffers non-nullified, enabling cross-request data leakage. Jetty 11 uses a different ContentProducer architecture where AsyncContentProducer.failCurrentContent() automatically nullifies buffers on any interception exception. This protection was part of the original ContentProducer design from March 2020 (commit 814dc69803f), predating CVE discovery by 4+ years. The upstream fix e3fa9466633 targets 9.4.57-SNAPSHOT and is not on the 11.0.19 branch because Jetty 11's architecture inherently prevents this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 is fixed in version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T12:00:44.024119+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server, and is fixed in 11.0.19-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "action_statement": "Vulnerability CVE-2024-8184 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server, and is fixed in 11.0.19-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 11.0.19 is not affected by CVE-2026-10051 (HTTP trailer cross-request leakage). The target version has a fundamentally different architecture from the vulnerable Jetty 12. In Jetty 11, the `_trailers` field is managed in `HttpChannelOverHttp.java` and is reliably reset to null in the `recycle()` method, which is called after each HTTP request completes. This architectural defense prevents...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.19 is not affected by CVE-2026-10051 (HTTP trailer cross-request leakage). The target version has a fundamentally different architecture from the vulnerable Jetty 12. In Jetty 11, the `_trailers` field is managed in `HttpChannelOverHttp.java` and is reliably reset to null in the `recycle()` method, which is called after each HTTP request completes. This architectural defense prevents..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server. Version 11.0.19 is not vulnerable. Summary: Target repository is Jetty 11.0.19, which is not affected by CVE-2026-1605. This CVE specifically affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.1.5). Jetty 11 uses a fundamentally different architecture where request decompression resource cleanup is properly tied to the request lifecycle via HttpInput.recycle(), not to response compression status. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 11.0.19 is not vulnerable. Summary: Target repository is Jetty 11.0.19, which is not affected by CVE-2026-1605. This CVE specifically affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.1.5). Jetty 11 uses a fundamentally different architecture where request decompression resource cleanup is properly tied to the request lifecycle via HttpInput.recycle(), not to response compression status. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:00.089427+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server, and is fixed in 11.0.19-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "action_statement": "Vulnerability CVE-2026-6790 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:jetty-server, and is fixed in 11.0.19-tuxcare.4."
    }
  ]
}