{
  "@id": "urn:uuid:d7f324e2-df16-4f4a-80f6-db9555a358bf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 38,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:46:52.268713+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:07:22.154174+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 describes predictable session IDs from using java.util.Random. Jetty 11.0.30 uses java.security.SecureRandom by default for session ID generation (DefaultSessionIdManager.java line 359). The vulnerable pattern (default/exclusive use of weak Random) is not present. The fix was shipped in the upstream Jetty release before TuxCare onboarding (first TuxCare commit 550492a850 \"setup 11...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 describes predictable session IDs from using java.util.Random. Jetty 11.0.30 uses java.security.SecureRandom by default for session ID generation (DefaultSessionIdManager.java line 359). The vulnerable pattern (default/exclusive use of weak Random) is not present. The fix was shipped in the upstream Jetty release before TuxCare onboarding (first TuxCare commit 550492a850 \"setup 11..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 describes a hash collision DOS attack against Jetty's form parameter processing in versions 8.1.0.RC2 and earlier. The target repository (Jetty 11.0.30.tuxcare0002) is NOT affected because the upstream fix (commit 085c79d7d6c) was already present in the upstream Jetty 11.0.26 release that TuxCare onboarded. The fix introduces a maxFormKeys parameter (default 1000) that limits the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-4461 describes a hash collision DOS attack against Jetty's form parameter processing in versions 8.1.0.RC2 and earlier. The target repository (Jetty 11.0.30.tuxcare0002) is NOT affected because the upstream fix (commit 085c79d7d6c) was already present in the upstream Jetty 11.0.26 release that TuxCare onboarded. The fix introduces a maxFormKeys parameter (default 1000) that limits the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T17:46:52.268713+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.30 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.30 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:28:17.034118+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9, where the PathResource class's path normalization mechanism on Windows allowed bypassing protected resource restrictions using escaped characters (particularly backslashes). The target repository (Jetty 11.0.30.tuxcare0002) is NOT vulnerable because the upstream fix was already present in the release. The fix (commit 97af3d663fd by Joakim ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9, where the PathResource class's path normalization mechanism on Windows allowed bypassing protected resource restrictions using escaped characters (particularly backslashes). The target repository (Jetty 11.0.30.tuxcare0002) is NOT vulnerable because the upstream fix was already present in the release. The fix (commit 97af3d663fd by Joakim ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:42:49.066061+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. Target Jetty 11.0.30 is not affected by CVE-2017-7656 (HTTP Request Smuggling). The vulnerability, which allowed request smuggling via multiple Content-Length headers or Content-Length combined with Transfer-Encoding: chunked, was fixed in upstream commit a285deea42f (May 2018). This fix was already present in the upstream Jetty 11.0.26 release that TuxCare onboarded. The target enforces RFC7230 compliance by default, which rejects both MULTIPLE_CONTENT_LENGTHS and TRANSFER_ENCODING_WITH_CONTENT_LENGTH violations with HTTP 400 errors.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "Target Jetty 11.0.30 is not affected by CVE-2017-7656 (HTTP Request Smuggling). The vulnerability, which allowed request smuggling via multiple Content-Length headers or Content-Length combined with Transfer-Encoding: chunked, was fixed in upstream commit a285deea42f (May 2018). This fix was already present in the upstream Jetty 11.0.26 release that TuxCare onboarded. The target enforces RFC7230 compliance by default, which rejects both MULTIPLE_CONTENT_LENGTHS and TRANSFER_ENCODING_WITH_CONTENT_LENGTH violations with HTTP 400 errors.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:20:19.402749+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7658: HTTP Request Smuggling vulnerability is NOT present in target version 11.0.30. The vulnerability allowed bypassing authorization via ambiguous content-length headers (multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked). The fix was committed by upstream Jetty developer Greg Wilkins on 2018-05-17 in commit a285deea42f (\"Issue #2529 RFC2616 vs RFC7230 cleanup\") and shipped in the upstream release before TuxCare onboarding (first TuxCare commit 550492a850a \"setup 11.0.26\" came after the fix). The HttpParser now rejects requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers via the _hasContentLength flag and compliance violation checks, preventing request smuggling attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "CVE-2017-7658: HTTP Request Smuggling vulnerability is NOT present in target version 11.0.30. The vulnerability allowed bypassing authorization via ambiguous content-length headers (multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked). The fix was committed by upstream Jetty developer Greg Wilkins on 2018-05-17 in commit a285deea42f (\"Issue #2529 RFC2616 vs RFC7230 cleanup\") and shipped in the upstream release before TuxCare onboarding (first TuxCare commit 550492a850a \"setup 11.0.26\" came after the fix). The HttpParser now rejects requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers via the _hasContentLength flag and compliance violation checks, preventing request smuggling attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:32:43.249791+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. The target repository (Jetty 11.0.30) is not affected by CVE-2017-9735. The vulnerability (timing channel attack in password comparison) was fixed by upstream Jetty developers between May 2017 and June 2019 through a series of commits that replaced variable-time string comparisons with constant-time implementations. All fix commits were authored by upstream developers (Simone Bordet simone.bordet@gmail.com, Greg Wilkins gregw@webtide.com) and were present in the upstream release before TuxCare onboarded version 11.0.26 in August 2025. The current implementation uses sophisticated constant-time comparison methods (stringEquals, byteEquals) that prevent timing-based password inference attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "The target repository (Jetty 11.0.30) is not affected by CVE-2017-9735. The vulnerability (timing channel attack in password comparison) was fixed by upstream Jetty developers between May 2017 and June 2019 through a series of commits that replaced variable-time string comparisons with constant-time implementations. All fix commits were authored by upstream developers (Simone Bordet simone.bordet@gmail.com, Greg Wilkins gregw@webtide.com) and were present in the upstream release before TuxCare onboarded version 11.0.26 in August 2025. The current implementation uses sophisticated constant-time comparison methods (stringEquals, byteEquals) that prevent timing-based password inference attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T18:10:00.174052+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 is not present in Jetty 11.0.30. The upstream vendor (Eclipse Jetty) fixed this information disclosure vulnerability in commit ad4dceb1c08 (issue #2560), which was already included in the upstream release before TuxCare onboarded version 11.0.26. The fix sanitizes exceptions during path processing to prevent filesystem path disclosure in error responses.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 is not present in Jetty 11.0.30. The upstream vendor (Eclipse Jetty) fixed this information disclosure vulnerability in commit ad4dceb1c08 (issue #2560), which was already included in the upstream release before TuxCare onboarded version 11.0.26. The fix sanitizes exceptions during path processing to prevent filesystem path disclosure in error responses."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. The target repository (Jetty 11.0.30) is not affected by CVE-2018-12545. The vulnerability allowed remote attackers to cause DoS via large HTTP/2 SETTINGS frames containing many key-value pairs, exhausting CPU and memory. The fix (commit 9eca404da29) adds a maxSettingsKeys limit (default 64) in SettingsBodyParser that rejects frames exceeding the limit with ENHANCE_YOUR_CALM_ERROR. This fix was already present in the upstream Jetty release that TuxCare onboarded (before commit 550492a850a \"setup 11.0.26\"), making it an upstream fix rather than a TuxCare backport. The defense code at SettingsBodyParser.java:193-200 increments a keys counter for each setting and rejects frames when keys > maxKeys, preventing the resource exhaustion attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "The target repository (Jetty 11.0.30) is not affected by CVE-2018-12545. The vulnerability allowed remote attackers to cause DoS via large HTTP/2 SETTINGS frames containing many key-value pairs, exhausting CPU and memory. The fix (commit 9eca404da29) adds a maxSettingsKeys limit (default 64) in SettingsBodyParser that rejects frames exceeding the limit with ENHANCE_YOUR_CALM_ERROR. This fix was already present in the upstream Jetty release that TuxCare onboarded (before commit 550492a850a \"setup 11.0.26\"), making it an upstream fix rather than a TuxCare backport. The defense code at SettingsBodyParser.java:193-200 increments a keys counter for each setting and rejects frames when keys > maxKeys, preventing the resource exhaustion attack.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:10:30.529368+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 11.0.30 is NOT affected by CVE-2019-10241. The XSS vulnerability in directory listings was fixed in upstream commit 1565b5f160e (Issue #3549) which was already present in the upstream release before TuxCare onboarded version 11.0.30. The CVE affects much older versions (9.2.26 and older, 9.3.25 and older, 9.4.15 and older). The target contains complete defenses: getFileName() met...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 Target version 11.0.30 is NOT affected by CVE-2019-10241. The XSS vulnerability in directory listings was fixed in upstream commit 1565b5f160e (Issue #3549) which was already present in the upstream release before TuxCare onboarded version 11.0.30. The CVE affects much older versions (9.2.26 and older, 9.3.25 and older, 9.4.15 and older). The target contains complete defenses: getFileName() met..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 affects Eclipse Jetty directory listing functionality on Windows, exposing fully qualified base resource directory paths. The target (Jetty 11.0.30.tuxcare0002) is NOT AFFECTED because the upstream fix was already present in the release when TuxCare onboarded it. The fix commit 3d028ab2ca7 (authored by Joakim Erdfelt) introduced a `getFileName()` method that extracts only the fil...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 affects Eclipse Jetty directory listing functionality on Windows, exposing fully qualified base resource directory paths. The target (Jetty 11.0.30.tuxcare0002) is NOT AFFECTED because the upstream fix was already present in the release when TuxCare onboarded it. The fix commit 3d028ab2ca7 (authored by Joakim Erdfelt) introduced a `getFileName()` method that extracts only the fil..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:35:00.088029+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247: Information disclosure vulnerability where Jetty's DefaultHandler reveals configured filesystem directory paths in 404 error pages. The target is NOT AFFECTED because the upstream fix (commit 04c994712c0 by Joakim Erdfelt, April 2019) was already included in Jetty 11.0.30 before TuxCare onboarded this version. The vulnerable code pattern (calling context.toString() which include...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247: Information disclosure vulnerability where Jetty's DefaultHandler reveals configured filesystem directory paths in 404 error pages. The target is NOT AFFECTED because the upstream fix (commit 04c994712c0 by Joakim Erdfelt, April 2019) was already included in Jetty 11.0.30 before TuxCare onboarded this version. The vulnerable code pattern (calling context.toString() which include..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:15:55.561862+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 describes an XSS vulnerability where Jetty's error handler does not escape exception messages in stack traces included in HTML/JSON error responses. The vendor fix (commits 9e40fc9a6fb and cf0df6e3ffd) adds sanitization via StringUtil.sanitizeXmlString() in writeErrorJson(), writeErrorPageStacks(), and the write() helper method. The target repository (org.eclipse.jetty:jetty-proj...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 describes an XSS vulnerability where Jetty's error handler does not escape exception messages in stack traces included in HTML/JSON error responses. The vendor fix (commits 9e40fc9a6fb and cf0df6e3ffd) adds sanitization via StringUtil.sanitizeXmlString() in writeErrorJson(), writeErrorPageStacks(), and the write() helper method. The target repository (org.eclipse.jetty:jetty-proj..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2019-17638 (double-release of ByteBuffer causing cross-client data leakage) is NOT PRESENT in target Jetty 11.0.30.tuxcare0002. The vulnerable code pattern was removed by upstream fix commit ff8ae56fa93 authored by gregw@webtide.com, which was already present in Jetty 11.0.26 when TuxCare onboarded this version branch. The fix moves the _chunk field from class-level to SendCallback instance scope and introduces releaseHeader()/releaseChunk() methods that both release buffers AND null references, preventing the double-release that enabled buffer reuse between concurrent HTTP transactions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "CVE-2019-17638 (double-release of ByteBuffer causing cross-client data leakage) is NOT PRESENT in target Jetty 11.0.30.tuxcare0002. The vulnerable code pattern was removed by upstream fix commit ff8ae56fa93 authored by gregw@webtide.com, which was already present in Jetty 11.0.26 when TuxCare onboarded this version branch. The fix moves the _chunk field from class-level to SendCallback instance scope and introduces releaseHeader()/releaseChunk() methods that both release buffers AND null references, preventing the double-release that enabled buffer reuse between concurrent HTTP transactions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:35:10.370659+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 (GZIP request body confusion) is NOT present in Jetty 11.0.30.tuxcare0002. The upstream vendor fix (commit 14f94f738df by Greg Wilkins) was released in Jetty 9.4.35.v20201120 and is present in the upstream Jetty 11.0.30 release that TuxCare onboarded. The fix adds ensureConsumeAllOrNotPersistent() which consumes remaining GZIP request body data (or adds Connection:close) before e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 (GZIP request body confusion) is NOT present in Jetty 11.0.30.tuxcare0002. The upstream vendor fix (commit 14f94f738df by Greg Wilkins) was released in Jetty 9.4.35.v20201120 and is present in the upstream Jetty 11.0.30 release that TuxCare onboarded. The fix adds ensureConsumeAllOrNotPersistent() which consumes remaining GZIP request body data (or adds Connection:close) before e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:28:51.823841+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223 is not present in the target. The vulnerability involved inefficient O(n\u00b2) bubble-sort-style sorting in QuotedQualityCSV that could cause DoS via CPU exhaustion when processing headers with many quality parameters. The target repository contains the upstream fix (commit 10e531756b9) which replaced the bubble sort with efficient O(n log n) stream-based sorting using Java's TimSort...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27223 is not present in the target. The vulnerability involved inefficient O(n\u00b2) bubble-sort-style sorting in QuotedQualityCSV that could cause DoS via CPU exhaustion when processing headers with many quality parameters. The target repository contains the upstream fix (commit 10e531756b9) which replaced the bubble sort with efficient O(n log n) stream-based sorting using Java's TimSort..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T12:26:45.505192+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2021-28165 does not affect this version. The vulnerability pattern is not present in the target repository (jetty-project 11.0.30) because the upstream fix was already included in the release when TuxCare onboarded it. The fix (commit 039c7386d0f by Simone Bordet, March 2021) adds a check in SslConnection.java that detects when the encrypted input buffer is full during BUFFER_UNDERFLOW and throws SSLHandshakeException instead of entering an infinite loop. This fix is present in the current code at jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java lines 756-760.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "CVE-2021-28165 does not affect this version. The vulnerability pattern is not present in the target repository (jetty-project 11.0.30) because the upstream fix was already included in the release when TuxCare onboarded it. The fix (commit 039c7386d0f by Simone Bordet, March 2021) adds a check in SslConnection.java that detects when the encrypted input buffer is full during BUFFER_UNDERFLOW and throws SSLHandshakeException instead of entering an infinite loop. This fix is present in the current code at jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java lines 756-760.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:21:00.131551+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2021-34428 is NOT present in jetty-project 11.0.30.tuxcare0002. The vulnerability (session ID not invalidated when SessionListener#sessionDestroyed() throws an exception) was fixed in upstream commit 087f486b446 by Jan Bartel, which shipped in the upstream release that TuxCare onboarded. The fix wraps session destroyed listener calls in try-catch and moves session ID invalidation into a fin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34428 is NOT present in jetty-project 11.0.30.tuxcare0002. The vulnerability (session ID not invalidated when SessionListener#sessionDestroyed() throws an exception) was fixed in upstream commit 087f486b446 by Jan Bartel, which shipped in the upstream release that TuxCare onboarded. The fix wraps session destroyed listener calls in try-catch and moves session ID invalidation into a fin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2022-2191 (ByteBuffer leak in SslConnection error paths) is NOT present in target version 11.0.30. The fix was already included in upstream Jetty release 10.0.10 (commit 66de7ba6180 by Ludovic Orban), well before the 11.0.26 base that TuxCare onboarded. The target contains the complete fix: exception handlers in fill() and flush() methods properly call discardInputBuffers() and discardEncryptedOutputBuffer() to release acquired ByteBuffers on error, preventing memory leaks during TLS handshake failures.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "CVE-2022-2191 (ByteBuffer leak in SslConnection error paths) is NOT present in target version 11.0.30. The fix was already included in upstream Jetty release 10.0.10 (commit 66de7ba6180 by Ludovic Orban), well before the 11.0.26 base that TuxCare onboarded. The target contains the complete fix: exception handlers in fill() and flush() methods properly call discardInputBuffers() and discardEncryptedOutputBuffer() to release acquired ByteBuffers on error, preventing memory leaks during TLS handshake failures.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:40:54.675757+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 11.0.30 is not affected by CVE-2023-26048. The vulnerability was fixed in upstream Jetty 11.0.14, and version 11.0.30 contains the complete fix. Both defense mechanisms from the upstream patch are present: (1) part count limit via _maxParts counter in MultiPartFormInputStream.startPart() at lines 816-818, and (2) content size accumulation and enforcement via formContentSize che...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 11.0.30 is not affected by CVE-2023-26048. The vulnerability was fixed in upstream Jetty 11.0.14, and version 11.0.30 contains the complete fix. Both defense mechanisms from the upstream patch are present: (1) part count limit via _maxParts counter in MultiPartFormInputStream.startPart() at lines 816-818, and (2) content size accumulation and enforcement via formContentSize che..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:12:00.105007+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 (cookie smuggling via nonstandard parsing of quoted values containing semicolons) is NOT present in the target. The vulnerability allowed attackers to smuggle cookies by exploiting Jetty's parsing of quoted cookie values: `DISPLAY_LANGUAGE=\"b; JSESSIONID=1337; c=d\"` would be parsed as one cookie instead of three, enabling HttpOnly cookie exfiltration. The upstream fix (commit 7b8...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via nonstandard parsing of quoted values containing semicolons) is NOT present in the target. The vulnerability allowed attackers to smuggle cookies by exploiting Jetty's parsing of quoted cookie values: `DISPLAY_LANGUAGE=\"b; JSESSIONID=1337; c=d\"` would be parsed as one cookie instead of three, enabling HttpOnly cookie exfiltration. The upstream fix (commit 7b8..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2024-13009 affects Jetty 9.4.0 to 9.4.56 where gzip inflation errors cause buffer reuse leading to data leakage. The target (Jetty 11.0.30) is NOT affected because the upstream vendor fix (commit e3fa9466633) was already present in the upstream 11.0.26 release when TuxCare onboarded it. The defensive code properly nulls content buffers when gzip inflation fails, preventing reuse across requests. This is an upstream fix by Greg Wilkins (Webtide), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "CVE-2024-13009 affects Jetty 9.4.0 to 9.4.56 where gzip inflation errors cause buffer reuse leading to data leakage. The target (Jetty 11.0.30) is NOT affected because the upstream vendor fix (commit e3fa9466633) was already present in the upstream 11.0.26 release when TuxCare onboarded it. The defensive code properly nulls content buffers when gzip inflation fails, preventing reuse across requests. This is an upstream fix by Greg Wilkins (Webtide), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. The target (Jetty 11.0.30) is not affected by CVE-2024-7708. The memory leak vulnerability was fixed in upstream release 11.0.23 (August 13, 2024) via commit 8259eabb by Simone Bordet. The fix adds proper buffer cleanup when HTTP request body reads return 0 bytes (particularly in 100-Continue scenarios), preventing the memory leak that could lead to DoS. This upstream fix was already present when TuxCare onboarded version 11.0.26 in August 2025, making it part of the baseline code rather than a TuxCare-specific backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "The target (Jetty 11.0.30) is not affected by CVE-2024-7708. The memory leak vulnerability was fixed in upstream release 11.0.23 (August 13, 2024) via commit 8259eabb by Simone Bordet. The fix adds proper buffer cleanup when HTTP request body reads return 0 bytes (particularly in 100-Continue scenarios), preventing the memory leak that could lead to DoS. This upstream fix was already present when TuxCare onboarded version 11.0.26 in August 2025, making it part of the baseline code rather than a TuxCare-specific backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. Jetty 11.0.30 is outside the affected range (12.0.0\u201312.0.35 and 12.1.0\u201312.1.9). CVE-2026-10051 affects the Jetty 12 lifecycle where connection-scoped trailer state can survive parser reuse. This code path is absent in Jetty 11.0.30, where the HTTP channel clears its trailer state during request recycle before the parser is reused. Therefore, trailer state cannot leak between requests in this version.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "Jetty 11.0.30 is outside the affected range (12.0.0\u201312.0.35 and 12.1.0\u201312.1.9). CVE-2026-10051 affects the Jetty 12 lifecycle where connection-scoped trailer state can survive parser reuse. This code path is absent in Jetty 11.0.30, where the HTTP channel clears its trailer state during request recycle before the parser is reused. Therefore, trailer state cannot leak between requests in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    }
  ]
}