{
  "@id": "urn:uuid:e3d8ffd6-4d94-43fb-9f40-f59660268f7c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 40,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:46:34.171368+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-03T15:07:22.154174+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 describes predictable session identifiers in Jetty due to use of java.util.Random instead of SecureRandom. The target repository (Jetty 11.0.29) is NOT vulnerable. The upstream fix was applied in April 2010 (commit c3275730b913, JETTY-1202) by Greg Wilkins, long before TuxCare's involvement. The current code (DefaultSessionIdManager.java:353-370) uses SecureRandom by default, only...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 describes predictable session identifiers in Jetty due to use of java.util.Random instead of SecureRandom. The target repository (Jetty 11.0.29) is NOT vulnerable. The upstream fix was applied in April 2010 (commit c3275730b913, JETTY-1202) by Greg Wilkins, long before TuxCare's involvement. The current code (DefaultSessionIdManager.java:353-370) uses SecureRandom by default, only..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 hash collision DoS vulnerability is not present in target version 11.0.29. The defense (maxFormKeys limit, default 1000) was implemented by upstream Jetty in commit 085c79d7d6c by Greg Wilkins and shipped in upstream release 11.0.26, which TuxCare onboarded. The vulnerable pattern (unbounded form parameter storage enabling hash collision attacks) does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-4461 hash collision DoS vulnerability is not present in target version 11.0.29. The defense (maxFormKeys limit, default 1000) was implemented by upstream Jetty in commit 085c79d7d6c by Greg Wilkins and shipped in upstream release 11.0.26, which TuxCare onboarded. The vulnerable pattern (unbounded form parameter storage enabling hash collision attacks) does not exist in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-06T17:46:34.171368+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.29 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.29 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-03T15:28:54.426721+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Jetty 9.3.x before 9.3.9 on Windows, allowing path traversal via escaped backslashes in URLs. The target version (Jetty 11.0.29) contains the upstream fix from May 2016 (commit 97af3d663fd) that was shipped in the original upstream release, 10 years before TuxCare onboarding. The fix adds URI-vs-normalized-path comparison in PathResource.checkAliasPath() (lines 71-84) that...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Jetty 9.3.x before 9.3.9 on Windows, allowing path traversal via escaped backslashes in URLs. The target version (Jetty 11.0.29) contains the upstream fix from May 2016 (commit 97af3d663fd) that was shipped in the original upstream release, 10 years before TuxCare onboarding. The fix adds URI-vs-normalized-path comparison in PathResource.checkAliasPath() (lines 71-84) that..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-03T12:42:09.520685+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. CVE-2017-7656 (HTTP Request Smuggling) is not present in Jetty 11.0.29. The upstream fix commit a285deea42f was already included in the upstream release before TuxCare onboarded version 11.0.26. The target code contains comprehensive defenses against request smuggling: HttpParser.java enforces RFC7230 compliance by default, rejecting requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers. The vulnerable pattern (accepting ambiguous body-length indicators) is not present in the default configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "CVE-2017-7656 (HTTP Request Smuggling) is not present in Jetty 11.0.29. The upstream fix commit a285deea42f was already included in the upstream release before TuxCare onboarded version 11.0.26. The target code contains comprehensive defenses against request smuggling: HttpParser.java enforces RFC7230 compliance by default, rejecting requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers. The vulnerable pattern (accepting ambiguous body-length indicators) is not present in the default configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-03T12:19:18.164920+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. CVE-2017-7658 (HTTP Request Smuggling via dual Content-Length headers) is not present in Jetty 11.0.29. The fix was implemented in upstream commit a285deea42fc by Greg Wilkins on 2018-05-17, before TuxCare's onboarding. The HttpParser enforces RFC7230 compliance by default, rejecting requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "CVE-2017-7658 (HTTP Request Smuggling via dual Content-Length headers) is not present in Jetty 11.0.29. The fix was implemented in upstream commit a285deea42fc by Greg Wilkins on 2018-05-17, before TuxCare's onboarding. The HttpParser enforces RFC7230 compliance by default, rejecting requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-03T12:31:15.270922+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. CVE-2017-9735 describes a timing attack in Jetty's Password.java that allows attackers to infer password characters by measuring response times. The vulnerability was fixed upstream in 2017-2018 through commits 042f325f1cd, f3751d70787, 2baa1abe4b1, and e727ad893d2, which replaced non-constant-time String.equals() with a constant-time stringEquals() method. All fix commits are ancestors of the first TuxCare commit (5559228a370 \"setup 11.0.26\"), confirming the fixes were already in the upstream release 11.0.26. Target version 11.0.29 has the complete constant-time implementation. Verdict: not_affected because the vulnerable code pattern is not present (upstream fix shipped in the release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 describes a timing attack in Jetty's Password.java that allows attackers to infer password characters by measuring response times. The vulnerability was fixed upstream in 2017-2018 through commits 042f325f1cd, f3751d70787, 2baa1abe4b1, and e727ad893d2, which replaced non-constant-time String.equals() with a constant-time stringEquals() method. All fix commits are ancestors of the first TuxCare commit (5559228a370 \"setup 11.0.26\"), confirming the fixes were already in the upstream release 11.0.26. Target version 11.0.29 has the complete constant-time implementation. Verdict: not_affected because the vulnerable code pattern is not present (upstream fix shipped in the release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-31T18:06:00.174621+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 is NOT present in Jetty 11.0.29. The vulnerability (information disclosure of full filesystem paths via InvalidPathException in error responses) was fixed by upstream commit 53e8bc2a636 in May 2018. This fix was already included in the upstream Jetty 11.0.26 release that TuxCare onboarded, confirmed by verifying the fix commit is an ancestor of the first TuxCare commit (5559228a3...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 is NOT present in Jetty 11.0.29. The vulnerability (information disclosure of full filesystem paths via InvalidPathException in error responses) was fixed by upstream commit 53e8bc2a636 in May 2018. This fix was already included in the upstream Jetty 11.0.26 release that TuxCare onboarded, confirmed by verifying the fix commit is an ancestor of the first TuxCare commit (5559228a3..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. CVE-2018-12545 affects Jetty 9.3.x/9.4.x with DoS via unlimited SETTINGS frame processing. Target version 11.0.29 contains upstream fixes: (1) maxKeys limit (64) rejecting frames with excessive settings (SettingsBodyParser.java:193-200), and (2) WindowRateControl rate-limiting frame arrival (SettingsBodyParser.java:223-224). Both defenses are enabled by default. Fixes were authored by simone.bordet@gmail.com and shipped in upstream release 9.4.12+ (July 2018), before TuxCare onboarded version 11.0.26 (first TuxCare commit 5559228a370, September 2024). Vulnerable pattern (unlimited settings processing) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 affects Jetty 9.3.x/9.4.x with DoS via unlimited SETTINGS frame processing. Target version 11.0.29 contains upstream fixes: (1) maxKeys limit (64) rejecting frames with excessive settings (SettingsBodyParser.java:193-200), and (2) WindowRateControl rate-limiting frame arrival (SettingsBodyParser.java:223-224). Both defenses are enabled by default. Fixes were authored by simone.bordet@gmail.com and shipped in upstream release 9.4.12+ (July 2018), before TuxCare onboarded version 11.0.26 (first TuxCare commit 5559228a370, September 2024). Vulnerable pattern (unlimited settings processing) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-31T16:06:54.632982+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target (Jetty 11.0.29.tuxcare0004) is NOT affected by CVE-2019-10241. The vulnerability was fixed upstream by Eclipse Jetty in April 2019 (commit 7b774d82e82) and was already present in Jetty 11.0.26 when TuxCare onboarded this version. All three defense mechanisms from the fix patches are present: getFileName() for safe filename extraction, deTag()/sanitizeXmlString() for HTML escaping of ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 The target (Jetty 11.0.29.tuxcare0004) is NOT affected by CVE-2019-10241. The vulnerability was fixed upstream by Eclipse Jetty in April 2019 (commit 7b774d82e82) and was already present in Jetty 11.0.26 when TuxCare onboarded this version. All three defense mechanisms from the fix patches are present: getFileName() for safe filename extraction, deTag()/sanitizeXmlString() for HTML escaping of ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 addresses information disclosure on Windows where directory listings exposed fully qualified filesystem paths instead of just filenames. The target (Jetty 11.0.29) is not affected because the upstream fix (commit 7b774d82e82 by Joakim Erdfelt) was already present in the Jetty release that TuxCare onboarded. The fix introduces a getFileName() method that extracts only the filename...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 addresses information disclosure on Windows where directory listings exposed fully qualified filesystem paths instead of just filenames. The target (Jetty 11.0.29) is not affected because the upstream fix (commit 7b774d82e82 by Joakim Erdfelt) was already present in the Jetty release that TuxCare onboarded. The fix introduces a getFileName() method that extracts only the filename..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-31T16:31:00.169715+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 affects DefaultHandler's 404 error output which revealed filesystem paths (base resource locations) via context.toString() calls. The target repository (Jetty 11.0.29.tuxcare0004) contains upstream fix commits from April 2019 that removed this vulnerability. The fix was authored by upstream developer Joakim Erdfelt and shipped in the upstream release before TuxCare's involvement....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 affects DefaultHandler's 404 error output which revealed filesystem paths (base resource locations) via context.toString() calls. The target repository (Jetty 11.0.29.tuxcare0004) contains upstream fix commits from April 2019 that removed this vulnerability. The fix was authored by upstream developer Joakim Erdfelt and shipped in the upstream release before TuxCare's involvement...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-02T19:15:55.561862+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 affected Jetty 9.4.21-23 (Sep-Nov 2019) where exception messages in error responses were not HTML-escaped, enabling potential XSS attacks. The upstream vendor (Eclipse Jetty) fixed this in November 2019 by adding StringUtil.sanitizeXmlString() to all error output paths (commits 9e40fc9a and cf0df6e3 by Joakim Erdfelt). TuxCare onboarded Jetty from version 9.4.48 (June 2022), whic...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 affected Jetty 9.4.21-23 (Sep-Nov 2019) where exception messages in error responses were not HTML-escaped, enabling potential XSS attacks. The upstream vendor (Eclipse Jetty) fixed this in November 2019 by adding StringUtil.sanitizeXmlString() to all error output paths (commits 9e40fc9a and cf0df6e3 by Joakim Erdfelt). TuxCare onboarded Jetty from version 9.4.48 (June 2022), whic..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. CVE-2019-17638 affects Eclipse Jetty 9.4.27\u20139.4.29 due to double-release of ByteBuffer on HTTP response header overflow. The target version 11.0.29 contains the upstream fix (commit ff8ae56fa93, June 2020) which reordered the HEADER_OVERFLOW case to prevent double-release by calling releaseHeader() that both releases AND nulls the pointer before acquiring a new buffer. The fix was already present in upstream release 11.0.26 when TuxCare onboarded this repository. The vulnerable pattern (release without nulling, followed by exception that triggers a second release) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "CVE-2019-17638 affects Eclipse Jetty 9.4.27\u20139.4.29 due to double-release of ByteBuffer on HTTP response header overflow. The target version 11.0.29 contains the upstream fix (commit ff8ae56fa93, June 2020) which reordered the HEADER_OVERFLOW case to prevent double-release by calling releaseHeader() that both releases AND nulls the pointer before acquiring a new buffer. The fix was already present in upstream release 11.0.26 when TuxCare onboarded this repository. The vulnerable pattern (release without nulling, followed by exception that triggers a second release) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-02T19:33:08.890881+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 11.0.29 is NOT AFFECTED by CVE-2020-27218. The vulnerability (unconsumed GZIP request body data leaking between persistent HTTP connections) was fixed by upstream Jetty in commit 14f94f738df (Nov 2020) and shipped in all Jetty 11.0.x releases starting with 11.0.0. TuxCare onboarded Jetty 11.0.26 in April 2026, which already contained the complete fix. The defensive mechanisms are...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 Target version 11.0.29 is NOT AFFECTED by CVE-2020-27218. The vulnerability (unconsumed GZIP request body data leaking between persistent HTTP connections) was fixed by upstream Jetty in commit 14f94f738df (Nov 2020) and shipped in all Jetty 11.0.x releases starting with 11.0.0. TuxCare onboarded Jetty 11.0.26 in April 2026, which already contained the complete fix. The defensive mechanisms are..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-02T19:28:01.029212+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Eclipse Jetty 11.0.29.tuxcare0004 is NOT AFFECTED by CVE-2020-27223. The vulnerable O(n\u00b2) bubble-sort algorithm in QuotedQualityCSV has been replaced with efficient O(n log n) stream-based sorting. The fix (commit 10e531756b9 from Feb 2021) was authored by upstream maintainer joakim.erdfelt@gmail.com and was already present in Jetty 11.0.1. When TuxCare onboarded version 11.0.26, the...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 The target Eclipse Jetty 11.0.29.tuxcare0004 is NOT AFFECTED by CVE-2020-27223. The vulnerable O(n\u00b2) bubble-sort algorithm in QuotedQualityCSV has been replaced with efficient O(n log n) stream-based sorting. The fix (commit 10e531756b9 from Feb 2021) was authored by upstream maintainer joakim.erdfelt@gmail.com and was already present in Jetty 11.0.1. When TuxCare onboarded version 11.0.26, the..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-03T12:25:55.953386+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. CVE-2021-28165 is NOT present in Jetty 11.0.29. The vulnerability involved an infinite CPU loop when processing invalid large TLS frames due to improper buffer space checking in SslConnection.java. The fix (commit 039c7386d0f by upstream developer Simone Bordet) was already included in the upstream release 11.0.29 before TuxCare onboarded it. The defensive code at lines 756-760 checks if buffer space equals zero and throws SSLHandshakeException before attempting further processing, preventing the CPU exhaustion attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "CVE-2021-28165 is NOT present in Jetty 11.0.29. The vulnerability involved an infinite CPU loop when processing invalid large TLS frames due to improper buffer space checking in SslConnection.java. The fix (commit 039c7386d0f by upstream developer Simone Bordet) was already included in the upstream release 11.0.29 before TuxCare onboarded it. The defensive code at lines 756-760 checks if buffer space equals zero and throws SSLHandshakeException before attempting further processing, preventing the CPU exhaustion attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-31T15:22:00.101796+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.29) is not affected by CVE-2021-34428. The vulnerability was fixed in upstream commit 087f486b446 (May 16, 2021) which wrapped sessionDestroyed listener calls in a try-catch block and moved the session ID manager invalidation call into a finally block. This fix was already present in Jetty 11.0.26 when TuxCare onboarded it (Dec 12, 2025). The vulnerable code pa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.29) is not affected by CVE-2021-34428. The vulnerability was fixed in upstream commit 087f486b446 (May 16, 2021) which wrapped sessionDestroyed listener calls in a try-catch block and moved the session ID manager invalidation call into a finally block. This fix was already present in Jetty 11.0.26 when TuxCare onboarded it (Dec 12, 2025). The vulnerable code pa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. CVE-2022-2191 is not present in the target. The vulnerability involved ByteBuffer memory leaks in SslConnection error paths when TLS operations failed (e.g., expired client certificates). The upstream Jetty project fixed this in commit 66de7ba6180 (June 2022) by adding proper buffer cleanup (discardInputBuffers/discardEncryptedOutputBuffer) in exception handlers. This fix was included in upstream Jetty 11.0.10+ releases. The target version 11.0.29 inherited this fix from the upstream 11.0.26 release that TuxCare onboarded, as confirmed by the presence of all fix methods and exception handler cleanup code in jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "CVE-2022-2191 is not present in the target. The vulnerability involved ByteBuffer memory leaks in SslConnection error paths when TLS operations failed (e.g., expired client certificates). The upstream Jetty project fixed this in commit 66de7ba6180 (June 2022) by adding proper buffer cleanup (discardInputBuffers/discardEncryptedOutputBuffer) in exception handlers. This fix was included in upstream Jetty 11.0.10+ releases. The target version 11.0.29 inherited this fix from the upstream 11.0.26 release that TuxCare onboarded, as confirmed by the presence of all fix methods and exception handler cleanup code in jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-31T15:37:56.759475+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 11.0.29 is not affected by CVE-2023-26048. The vulnerability was fixed in upstream Jetty 11.0.14, and the fix was already present in the upstream 11.0.26 release that TuxCare onboarded. Both defenses are present and active: (1) part count limiting (max 1000 parts) in MultiPartFormInputStream.java:816-818, and (2) non-file part size limiting (max 200KB) in Request.java:2417-2419. ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 Target version 11.0.29 is not affected by CVE-2023-26048. The vulnerability was fixed in upstream Jetty 11.0.14, and the fix was already present in the upstream 11.0.26 release that TuxCare onboarded. Both defenses are present and active: (1) part count limiting (max 1000 parts) in MultiPartFormInputStream.java:816-818, and (2) non-file part size limiting (max 200KB) in Request.java:2417-2419. ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-10-31T15:12:00.105007+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 (cookie smuggling via semicolons in quoted values) is NOT present in target version 11.0.29. The upstream fix commit 7b8c2c1bf08 by Simone Bordet was already included in upstream release 11.0.26, which TuxCare onboarded as the base for this version. The vulnerable code pattern (lenient `inQuoted` handling that allowed semicolons inside quoted cookie values) has been removed. The ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via semicolons in quoted values) is NOT present in target version 11.0.29. The upstream fix commit 7b8c2c1bf08 by Simone Bordet was already included in upstream release 11.0.26, which TuxCare onboarded as the base for this version. The vulnerable code pattern (lenient `inQuoted` handling that allowed semicolons inside quoted cookie values) has been removed. The ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. Eclipse Jetty 11.0.29.tuxcare0004 is not affected by CVE-2024-13009. The vulnerability (incorrect buffer release on gzip decompression errors leading to data corruption/sharing between requests) was fixed in upstream commit e3fa9466633 dated 2024-12-19, which shipped in upstream release 11.0.26 before TuxCare onboarded this version. The fix ensures that when gzip decompression fails in GzipHttpInputInterceptor, the AsyncContentProducer.failCurrentContent() method clears both _rawContent and _transformedContent buffer references to null, preventing reuse. This is the semantic equivalent of the 9.4.x patch, adapted to 11.0.x's ContentProducer architecture.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "Eclipse Jetty 11.0.29.tuxcare0004 is not affected by CVE-2024-13009. The vulnerability (incorrect buffer release on gzip decompression errors leading to data corruption/sharing between requests) was fixed in upstream commit e3fa9466633 dated 2024-12-19, which shipped in upstream release 11.0.26 before TuxCare onboarded this version. The fix ensures that when gzip decompression fails in GzipHttpInputInterceptor, the AsyncContentProducer.failCurrentContent() method clears both _rawContent and _transformedContent buffer references to null, preventing reuse. This is the semantic equivalent of the 9.4.x patch, adapted to 11.0.x's ContentProducer architecture.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. Target version 11.0.29 is NOT AFFECTED. The vulnerability (CVE-2024-7708) affected Jetty versions 11.0.0-11.0.22 and was fixed in upstream version 11.0.23. The target version 11.0.29 already contains the upstream fix (commit 8259eabbc70 by Simone Bordet) that properly releases request buffers when fillRequestBuffer() returns 0 or negative bytes, preventing the memory leak. This fix was present in the upstream release that TuxCare onboarded (version 11.0.26), not applied as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "Target version 11.0.29 is NOT AFFECTED. The vulnerability (CVE-2024-7708) affected Jetty versions 11.0.0-11.0.22 and was fixed in upstream version 11.0.23. The target version 11.0.29 already contains the upstream fix (commit 8259eabbc70 by Simone Bordet) that properly releases request buffers when fillRequestBuffer() returns 0 or negative bytes, preventing the memory leak. This fix was present in the upstream release that TuxCare onboarded (version 11.0.26), not applied as a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 affects version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "action_statement": "Vulnerability CVE-2026-10051 affects version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server. Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.29.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 11.0.29.tuxcare0003 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    }
  ]
}