{
  "@id": "urn:uuid:7c2bb0dc-ef12-4d19-9b3a-f0a90d44558e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 38,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:15:51.446651+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:08:01.045470+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 affects Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3 due to predictable session ID generation using java.util.Random. The target version (11.0.28) uses java.security.SecureRandom by default for session ID generation, which provides cryptographically secure random numbers. The vulnerable pattern (using predictable java.util.Random) is not present in the default code p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 affects Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3 due to predictable session ID generation using java.util.Random. The target version (11.0.28) uses java.security.SecureRandom by default for session ID generation, which provides cryptographically secure random numbers. The vulnerable pattern (using predictable java.util.Random) is not present in the default code p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 11.0.28 is not affected by CVE-2011-4461. The vulnerability (unbounded form parameter processing allowing hash collision DOS attacks) was fixed in upstream Jetty commit 085c79d7d6c on 2011-12-30 by Greg Wilkins. This fix added maxFormKeys protection (default 1000) to limit the number of form parameters that can be processed. The fix was already present in the upstream Jetty 11....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 11.0.28 is not affected by CVE-2011-4461. The vulnerability (unbounded form parameter processing allowing hash collision DOS attacks) was fixed in upstream Jetty commit 085c79d7d6c on 2011-12-30 by Greg Wilkins. This fix added maxFormKeys protection (default 1000) to limit the number of form parameters that can be processed. The fix was already present in the upstream Jetty 11...."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "action_statement": "Vulnerability CVE-2015-2080 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T15:28:17.034118+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 due to improper path normalization on Windows that allowed bypassing security constraints via URLs with escaped backslashes. The target version 11.0.28 is not affected because the upstream fix (commit 97af3d663fd, dated 2016-05-13) was already present in the upstream release that TuxCare onboarded. The fix enhances PathResource.checkAliasPa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 due to improper path normalization on Windows that allowed bypassing security constraints via URLs with escaped backslashes. The target version 11.0.28 is not affected because the upstream fix (commit 97af3d663fd, dated 2016-05-13) was already present in the upstream release that TuxCare onboarded. The fix enhances PathResource.checkAliasPa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:41:38.446812+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2017-7656 HTTP Request Smuggling vulnerability is not present in Jetty 11.0.28. The fix was authored by upstream vendor Greg Wilkins in commit a285deea42f (May 2018) and shipped in all Jetty 11.x releases. The target's HttpParser.java implements the fix at lines 977-999, rejecting multiple Content-Length headers and mixed Content-Length + Transfer-Encoding headers via HttpCompliance checks. Default compliance mode is RFC7230 which blocks both violations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "CVE-2017-7656 HTTP Request Smuggling vulnerability is not present in Jetty 11.0.28. The fix was authored by upstream vendor Greg Wilkins in commit a285deea42f (May 2018) and shipped in all Jetty 11.x releases. The target's HttpParser.java implements the fix at lines 977-999, rejecting multiple Content-Length headers and mixed Content-Length + Transfer-Encoding headers via HttpCompliance checks. Default compliance mode is RFC7230 which blocks both violations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:19:18.164920+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. The target repository (Eclipse Jetty 11.0.28.tuxcare0005) is not affected by CVE-2017-7658. The vulnerability pattern has been removed by an upstream vendor fix that shipped in the release TuxCare onboarded. The fix properly rejects HTTP requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding: chunked headers, blocking the request smuggling attack vector. Default compliance mode (RFC7230) enforces these restrictions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "The target repository (Eclipse Jetty 11.0.28.tuxcare0005) is not affected by CVE-2017-7658. The vulnerability pattern has been removed by an upstream vendor fix that shipped in the release TuxCare onboarded. The fix properly rejects HTTP requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding: chunked headers, blocking the request smuggling attack vector. Default compliance mode (RFC7230) enforces these restrictions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:30:34.591989+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2017-9735 timing channel vulnerability is NOT PRESENT in target version 11.0.28. The fix (constant-time password comparison methods) was already included in the upstream Jetty 11.0.26 release that TuxCare onboarded. The vulnerable pattern (variable-time string comparison using .equals() and .equalsIgnoreCase()) has been replaced with timing-safe stringEquals() and byteEquals() methods throughout Password.java, Credential.java, and DigestAuthenticator.java. The fix was authored by upstream Jetty maintainer Simone Bordet, not by TuxCare/CloudLinux.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 timing channel vulnerability is NOT PRESENT in target version 11.0.28. The fix (constant-time password comparison methods) was already included in the upstream Jetty 11.0.26 release that TuxCare onboarded. The vulnerable pattern (variable-time string comparison using .equals() and .equalsIgnoreCase()) has been replaced with timing-safe stringEquals() and byteEquals() methods throughout Password.java, Credential.java, and DigestAuthenticator.java. The fix was authored by upstream Jetty maintainer Simone Bordet, not by TuxCare/CloudLinux.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T18:04:40.428853+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 (server filesystem path disclosure via InvalidPathException) is NOT present in target version 11.0.28. The vulnerability pattern was removed by upstream Jetty fixes (commits ad4dceb1c08 and 53e8bc2a636) that shipped in Jetty 11.0.26 before TuxCare onboarded the version. ResourceContentFactory.getContent() wraps all resource-loading exceptions in a try-catch block and re-throws sa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 (server filesystem path disclosure via InvalidPathException) is NOT present in target version 11.0.28. The vulnerability pattern was removed by upstream Jetty fixes (commits ad4dceb1c08 and 53e8bc2a636) that shipped in Jetty 11.0.26 before TuxCare onboarded the version. ResourceContentFactory.getContent() wraps all resource-loading exceptions in a try-catch block and re-throws sa..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2018-12545 fix is already present in Eclipse Jetty 11.0.28. The vulnerability (DoS via unbounded SETTINGS frame processing) is mitigated by two defenses that shipped in the upstream release: (1) per-frame key limit (DEFAULT_MAX_KEYS=64) enforced in SettingsBodyParser.onSetting(), and (2) frame rate control enforced via RateControl interface. The fix was authored by Simone Bordet (simone.bordet@gmail.com) in upstream commit 9eca404da29 for issue #2722, which predates TuxCare's onboarding commit (3f3b8a6). Target version 11.0.28 inherits this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 fix is already present in Eclipse Jetty 11.0.28. The vulnerability (DoS via unbounded SETTINGS frame processing) is mitigated by two defenses that shipped in the upstream release: (1) per-frame key limit (DEFAULT_MAX_KEYS=64) enforced in SettingsBodyParser.onSetting(), and (2) frame rate control enforced via RateControl interface. The fix was authored by Simone Bordet (simone.bordet@gmail.com) in upstream commit 9eca404da29 for issue #2722, which predates TuxCare's onboarding commit (3f3b8a6). Target version 11.0.28 inherits this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T16:04:52.319065+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Eclipse Jetty 11.0.28 is not affected by CVE-2019-10241. The XSS vulnerability in directory listings was fixed in upstream commit ca77bd384a2 (April 2019) by Joakim Erdfelt, which was already included in the upstream release before TuxCare onboarded version 11.0.26. The fix adds proper query parameter validation and HTML escaping to prevent malicious JavaScript injection via speciall...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 The target Eclipse Jetty 11.0.28 is not affected by CVE-2019-10241. The XSS vulnerability in directory listings was fixed in upstream commit ca77bd384a2 (April 2019) by Joakim Erdfelt, which was already included in the upstream release before TuxCare onboarded version 11.0.26. The fix adds proper query parameter validation and HTML escaping to prevent malicious JavaScript injection via speciall..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.28.tuxcare0005) is not affected by CVE-2019-10246. The vulnerability, which exposed fully qualified directory paths in directory listings on Windows, was fixed in upstream commit 7b774d82e82 (Issue #3549) by Joakim Erdfelt in April 2019. This fix was already present in the upstream Jetty release that TuxCare onboarded (before the first TuxCare commit 676c95d749...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.28.tuxcare0005) is not affected by CVE-2019-10246. The vulnerability, which exposed fully qualified directory paths in directory listings on Windows, was fixed in upstream commit 7b774d82e82 (Issue #3549) by Joakim Erdfelt in April 2019. This fix was already present in the upstream Jetty release that TuxCare onboarded (before the first TuxCare commit 676c95d749..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T16:27:26.409965+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 affects Jetty versions that expose filesystem directory paths in DefaultHandler's 404 error pages. Target version 11.0.28 is not affected because the upstream fix (commit d983890d1769744e7da865de7ff34065fe491a28 by Joakim Erdfelt, April 2019) was already present in the upstream release before TuxCare onboarding. The current code displays only context path, display name, availabil...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 affects Jetty versions that expose filesystem directory paths in DefaultHandler's 404 error pages. Target version 11.0.28 is not affected because the upstream fix (commit d983890d1769744e7da865de7ff34065fe491a28 by Joakim Erdfelt, April 2019) was already present in the upstream release before TuxCare onboarding. The current code displays only context path, display name, availabil..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T19:15:00.519823+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 11.0.28 is not affected by CVE-2019-17632. The vulnerability (unescaped exception messages in error responses enabling XSS) was fixed in upstream Jetty commits 9e40fc9a6fb and cf0df6e3ffd (Issue #4334) which introduced sanitization via StringUtil.sanitizeXmlString(). These fixes were already present in the upstream release before TuxCare began maintenance at version 11.0.26. The ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 Target version 11.0.28 is not affected by CVE-2019-17632. The vulnerability (unescaped exception messages in error responses enabling XSS) was fixed in upstream Jetty commits 9e40fc9a6fb and cf0df6e3ffd (Issue #4334) which introduced sanitization via StringUtil.sanitizeXmlString(). These fixes were already present in the upstream release before TuxCare began maintenance at version 11.0.26. The ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2019-17638 (ByteBuffer double-release vulnerability) is NOT present in target version 11.0.28. The upstream fix commit ff8ae56fa93 by Greg Wilkins was shipped in the upstream Jetty release that TuxCare onboarded, predating all TuxCare work on this branch. The vulnerable pattern (class-level shared _chunk buffer, lack of null-after-release) has been completely removed. The fix properly scopes _chunk to SendCallback instances and implements releaseHeader()/releaseChunk() methods that null references after releasing buffers, preventing double-release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "CVE-2019-17638 (ByteBuffer double-release vulnerability) is NOT present in target version 11.0.28. The upstream fix commit ff8ae56fa93 by Greg Wilkins was shipped in the upstream Jetty release that TuxCare onboarded, predating all TuxCare work on this branch. The vulnerable pattern (class-level shared _chunk buffer, lack of null-after-release) has been completely removed. The fix properly scopes _chunk to SendCallback instances and implements releaseHeader()/releaseChunk() methods that null references after releasing buffers, preventing double-release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T19:33:31.796686+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 (GZIP request body prepending vulnerability) is NOT present in target version 11.0.28. The upstream vendor fix (Issue #5605, commit 14f94f738df by Greg Wilkins) shipped in the upstream release before TuxCare onboarded version 11.0.26. All defense components verified present in HEAD: HttpChannel.ensureConsumeAllOrNotPersistent() drains intercepted content and adds Connection:close...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 (GZIP request body prepending vulnerability) is NOT present in target version 11.0.28. The upstream vendor fix (Issue #5605, commit 14f94f738df by Greg Wilkins) shipped in the upstream release before TuxCare onboarded version 11.0.26. All defense components verified present in HEAD: HttpChannel.ensureConsumeAllOrNotPersistent() drains intercepted content and adds Connection:close..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T19:27:33.940034+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.28.tuxcare0005) is not affected by CVE-2020-27223. The vulnerability involved an inefficient O(n\u00b2) bubble-sort algorithm in QuotedQualityCSV that could cause DoS via CPU exhaustion when processing HTTP headers with many quality parameters. The fix (commit 10e531756b9) replaced this with efficient O(n log n) comparator-based sorting using a QualityValue class im...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.28.tuxcare0005) is not affected by CVE-2020-27223. The vulnerability involved an inefficient O(n\u00b2) bubble-sort algorithm in QuotedQualityCSV that could cause DoS via CPU exhaustion when processing HTTP headers with many quality parameters. The fix (commit 10e531756b9) replaced this with efficient O(n log n) comparator-based sorting using a QualityValue class im..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:25:11.887724+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2021-28165 is NOT present in Jetty 11.0.28.tuxcare0005. The vulnerability (infinite CPU loop when processing oversized TLS frames >17408 bytes) was fixed by upstream commit 039c7386d0f authored by Simone Bordet. The fix reorders the BUFFER_UNDERFLOW handling to check buffer space BEFORE attempting to continue processing, preventing the infinite loop. This fix was already included in the upstream Jetty 11.0.28 release that TuxCare onboarded, confirmed by the fix commit being an ancestor of the first TuxCare setup commit (676c95d7493).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "CVE-2021-28165 is NOT present in Jetty 11.0.28.tuxcare0005. The vulnerability (infinite CPU loop when processing oversized TLS frames >17408 bytes) was fixed by upstream commit 039c7386d0f authored by Simone Bordet. The fix reorders the BUFFER_UNDERFLOW handling to check buffer space BEFORE attempting to continue processing, preventing the infinite loop. This fix was already included in the upstream Jetty 11.0.28 release that TuxCare onboarded, confirmed by the fix commit being an ancestor of the first TuxCare setup commit (676c95d7493).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:22:00.101796+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2021-34428: Target repository is NOT AFFECTED. The vulnerability (session ID not invalidated when SessionListener#sessionDestroyed() throws exception) was fixed in upstream Jetty commit 087f486b446 (Issue #6277) by Jan Bartel. This fix was already present in upstream Jetty 11.0.26 before TuxCare onboarded the version. The target at commit e45f928f28c (version 11.0.28.tuxcare0005) contains t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34428: Target repository is NOT AFFECTED. The vulnerability (session ID not invalidated when SessionListener#sessionDestroyed() throws exception) was fixed in upstream Jetty commit 087f486b446 (Issue #6277) by Jan Bartel. This fix was already present in upstream Jetty 11.0.26 before TuxCare onboarded the version. The target at commit e45f928f28c (version 11.0.28.tuxcare0005) contains t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2022-2191 describes a memory leak vulnerability in Jetty's SslConnection where ByteBuffers are not released in error code paths (e.g., TLS handshake failures with expired client certificates). The target repository (jetty-project 11.0.28.tuxcare0005) contains the complete upstream fix from commit 66de7ba6180, which was committed on 2022-06-15 by Ludovic Orban and first shipped in jetty-11.0.10. The fix adds buffer discard logic in exception handlers throughout SslConnection.java, ensuring ByteBuffers are properly cleared and released back to the pool when exceptions occur. Since this fix shipped in the upstream release that TuxCare onboarded (11.0.26+), the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "CVE-2022-2191 describes a memory leak vulnerability in Jetty's SslConnection where ByteBuffers are not released in error code paths (e.g., TLS handshake failures with expired client certificates). The target repository (jetty-project 11.0.28.tuxcare0005) contains the complete upstream fix from commit 66de7ba6180, which was committed on 2022-06-15 by Ludovic Orban and first shipped in jetty-11.0.10. The fix adds buffer discard logic in exception handlers throughout SslConnection.java, ensuring ByteBuffers are properly cleared and released back to the pool when exceptions occur. Since this fix shipped in the upstream release that TuxCare onboarded (11.0.26+), the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:37:56.759475+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty 11.0.28 is NOT AFFECTED by CVE-2023-26048. The upstream fix (commit a5344d7a260 by Lachlan Roberts) was already present in the upstream Jetty 11.0.28 release before TuxCare onboarded it. Both required protections are in place: (1) maximum part count limit (default 1000) prevents memory exhaustion from too many multipart parts, and (2) form content size tracking (default 200KB) prev...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 11.0.28 is NOT AFFECTED by CVE-2023-26048. The upstream fix (commit a5344d7a260 by Lachlan Roberts) was already present in the upstream Jetty 11.0.28 release before TuxCare onboarded it. Both required protections are in place: (1) maximum part count limit (default 1000) prevents memory exhaustion from too many multipart parts, and (2) form content size tracking (default 200KB) prev..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:10:02.627231+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values with semicolons) does not affect Jetty 11.0.28.tuxcare0005. The upstream fix (commit 7b8c2c1bf08, authored by Simone Bordet) was included in Jetty 11.0.15 (Feb 2023) and shipped in the upstream release that TuxCare onboarded for version 11.0.26. The target's RFC6265CookieParser correctly rejects cookies containing semicolons within quoted value...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values with semicolons) does not affect Jetty 11.0.28.tuxcare0005. The upstream fix (commit 7b8c2c1bf08, authored by Simone Bordet) was included in Jetty 11.0.15 (Feb 2023) and shipped in the upstream release that TuxCare onboarded for version 11.0.26. The target's RFC6265CookieParser correctly rejects cookies containing semicolons within quoted value..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2024-13009 explicitly affects Eclipse Jetty versions 9.4.0 to 9.4.56. The target version 11.0.28 uses a completely different architecture (ContentProducer pattern) that already incorporates the buffer nulling defense that the 9.4.x patch adds. The AsyncContentProducer.failCurrentContent() method (lines 209-235) nulls both _rawContent and _transformedContent when gzip inflation errors occur, preventing buffer reuse across requests. This defense is reachable on all gzip error paths through the intercept() try-catch block (line 451-465).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "CVE-2024-13009 explicitly affects Eclipse Jetty versions 9.4.0 to 9.4.56. The target version 11.0.28 uses a completely different architecture (ContentProducer pattern) that already incorporates the buffer nulling defense that the 9.4.x patch adds. The AsyncContentProducer.failCurrentContent() method (lines 209-235) nulls both _rawContent and _transformedContent when gzip inflation errors occur, preventing buffer reuse across requests. This defense is reachable on all gzip error paths through the intercept() try-catch block (line 451-465).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. CVE-2024-7708 affects Jetty 11.0.0-11.0.22 with a memory leak in HttpConnection when reading 0 bytes from request bodies (100-Continue, slow networks). The target version 11.0.28.tuxcare0005 contains the upstream fix (commit 8259eabbc70ae) that adds releaseRequestBuffer() calls when filled <= 0 bytes or exceptions occur. This fix shipped in upstream release 11.0.23 before TuxCare onboarded version 11.0.26. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "CVE-2024-7708 affects Jetty 11.0.0-11.0.22 with a memory leak in HttpConnection when reading 0 bytes from request bodies (100-Continue, slow networks). The target version 11.0.28.tuxcare0005 contains the upstream fix (commit 8259eabbc70ae) that adds releaseRequestBuffer() calls when filled <= 0 bytes or exceptions occur. This fix shipped in upstream release 11.0.23 before TuxCare onboarded version 11.0.26. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 11.0.28 is not affected by CVE-2026-10051. The vulnerability describes trailer leakage in Jetty 12.x's redesigned internal.HttpConnection where the _trailers field was never cleared between requests. Jetty 11.0.28 has a fundamentally different architecture where _trailers exists in HttpChannelOverHttp and is properly cleared via the established recycle() mechanism between HTTP/1.1 keep-al...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.28 is not affected by CVE-2026-10051. The vulnerability describes trailer leakage in Jetty 12.x's redesigned internal.HttpConnection where the _trailers field was never cleared between requests. Jetty 11.0.28 has a fundamentally different architecture where _trailers exists in HttpChannelOverHttp and is properly cleared via the established recycle() mechanism between HTTP/1.1 keep-al..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server. Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server, and is fixed in 11.0.28.tuxcare0004.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "action_statement": "Vulnerability CVE-2026-6790 affects version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-server, and is fixed in 11.0.28.tuxcare0004."
    }
  ]
}