{ "@id": "urn:uuid:59761395-c3b8-459b-837f-b6468ce9ca2c", "role": "Document Creator", "author": "https://tuxcare.com", "version": 37, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T17:47:26.501853+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-03T15:08:44.196020+00:00", "status_notes": "Vulnerability CVE-2006-6969 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 concerns predictable session ID generation using java.util.Random in Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3. The target (Jetty 11.0.31) uses SecureRandom by default for session ID generation (DefaultSessionIdManager.java:359), with only an exceptional fallback to Random when SecureRandom initialization fails (line 364). This fix was already present in the upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2006-6969" }, "impact_statement": "not_affected \u2014 CVE-2006-6969 concerns predictable session ID generation using java.util.Random in Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3. The target (Jetty 11.0.31) uses SecureRandom by default for session ID generation (DefaultSessionIdManager.java:359), with only an exceptional fallback to Random when SecureRandom initialization fails (line 364). This fix was already present in the upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2011-4461 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 describes a hash collision DoS vulnerability in Jetty's form parameter processing where attackers can send many crafted parameters that hash to the same bucket, causing excessive CPU consumption. The vendor fix (commit 085c79d7d6cfbccc02821ffdb64968593df3e0bf from Dec 30, 2011) introduced a maxFormKeys limit (default 1000) to prevent this attack. This fix is present in the target ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-4461" }, "impact_statement": "not_affected \u2014 CVE-2011-4461 describes a hash collision DoS vulnerability in Jetty's form parameter processing where attackers can send many crafted parameters that hash to the same bucket, causing excessive CPU consumption. The vendor fix (commit 085c79d7d6cfbccc02821ffdb64968593df3e0bf from Dec 30, 2011) introduced a maxFormKeys limit (default 1000) to prevent this attack. This fix is present in the target ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-06T17:47:26.501853+00:00", "status_notes": "Vulnerability CVE-2015-2080 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.31 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-2080" }, "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 11.0.31 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-03T15:31:44.936589+00:00", "status_notes": "Vulnerability CVE-2016-4800 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 is NOT present in Jetty 11.0.31. The vulnerability affected Jetty 9.3.x before 9.3.9 and involved improper path normalization on Windows that allowed bypassing security constraints via escaped characters (particularly backslashes). The fix (commit 97af3d663fd, May 2016) was applied by upstream in Jetty 9.3.9 and is present in version 11.0.31. The fix detects when the filesystem no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4800" }, "impact_statement": "not_affected \u2014 CVE-2016-4800 is NOT present in Jetty 11.0.31. The vulnerability affected Jetty 9.3.x before 9.3.9 and involved improper path normalization on Windows that allowed bypassing security constraints via escaped characters (particularly backslashes). The fix (commit 97af3d663fd, May 2016) was applied by upstream in Jetty 9.3.9 and is present in version 11.0.31. The fix detects when the filesystem no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-03T12:44:25.010068+00:00", "status_notes": "Vulnerability CVE-2017-7656 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7656 HTTP Request Smuggling vulnerability is not present in Jetty 11.0.31. The upstream fix (commit a285deea42f by Greg Wilkins) was included in Jetty 9.2.25 (June 2018) and was already present in the upstream release before TuxCare onboarding. The fix introduces compliance violation checks for MULTIPLE_CONTENT_LENGTHS and TRANSFER_ENCODING_WITH_CONTENT_LENGTH, which are enforced by default in RFC7230 compliance mode (the default). The vulnerable pattern only manifests in non-default RFC2616_LEGACY configuration, matching the CVE's description of \"non-default configuration with RFC2616 compliance enabled.\"\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7656" }, "impact_statement": "CVE-2017-7656 HTTP Request Smuggling vulnerability is not present in Jetty 11.0.31. The upstream fix (commit a285deea42f by Greg Wilkins) was included in Jetty 9.2.25 (June 2018) and was already present in the upstream release before TuxCare onboarding. The fix introduces compliance violation checks for MULTIPLE_CONTENT_LENGTHS and TRANSFER_ENCODING_WITH_CONTENT_LENGTH, which are enforced by default in RFC7230 compliance mode (the default). The vulnerable pattern only manifests in non-default RFC2616_LEGACY configuration, matching the CVE's description of \"non-default configuration with RFC2616 compliance enabled.\"\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2017-7657 affects version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-7657" }, "action_statement": "Vulnerability CVE-2017-7657 affects version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-03T12:21:26.071673+00:00", "status_notes": "Vulnerability CVE-2017-7658 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Target Jetty 11.0.31 is NOT AFFECTED by CVE-2017-7658 (HTTP Request Smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked). The upstream fix (commit a285deea42f by Greg Wilkins, May 17, 2018) was already included in Jetty 11.0.26, which TuxCare onboarded. The target's HttpParser validates headers and throws HTTP 400 Bad Request when encountering multiple Content-Length headers or both Content-Length and Transfer-Encoding: chunked, preventing request smuggling. Default RFC7230 compliance mode enforces these checks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-7658" }, "impact_statement": "Target Jetty 11.0.31 is NOT AFFECTED by CVE-2017-7658 (HTTP Request Smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked). The upstream fix (commit a285deea42f by Greg Wilkins, May 17, 2018) was already included in Jetty 11.0.26, which TuxCare onboarded. The target's HttpParser validates headers and throws HTTP 400 Bad Request when encountering multiple Content-Length headers or both Content-Length and Transfer-Encoding: chunked, preventing request smuggling. Default RFC7230 compliance mode enforces these checks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-03T12:33:19.742472+00:00", "status_notes": "Vulnerability CVE-2017-9735 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Target repository Jetty 11.0.31 is not affected by CVE-2017-9735 (timing channel attack in password comparison). The vulnerability was fixed by upstream commits 042f325f1cd6, f3751d70787f, 2baa1abe4b1c, and a7e8b4220a41 (authored by Simone Bordet and Greg Wilkins, May-August 2017) which introduced constant-time comparison methods (stringEquals(), byteEquals()). These fixes were already present in the upstream Jetty 11.0.26 release that TuxCare onboarded, confirmed by merge-base analysis showing all fix commits predate the first TuxCare commit 5dc9759246d (\"setup 11.0.26\" by askorik@cloudlinux.com). The current code uses constant-time comparisons throughout password validation paths, eliminating the timing side-channel.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-9735" }, "impact_statement": "Target repository Jetty 11.0.31 is not affected by CVE-2017-9735 (timing channel attack in password comparison). The vulnerability was fixed by upstream commits 042f325f1cd6, f3751d70787f, 2baa1abe4b1c, and a7e8b4220a41 (authored by Simone Bordet and Greg Wilkins, May-August 2017) which introduced constant-time comparison methods (stringEquals(), byteEquals()). These fixes were already present in the upstream Jetty 11.0.26 release that TuxCare onboarded, confirmed by merge-base analysis showing all fix commits predate the first TuxCare commit 5dc9759246d (\"setup 11.0.26\" by askorik@cloudlinux.com). The current code uses constant-time comparisons throughout password validation paths, eliminating the timing side-channel.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-10-31T18:16:52.560467+00:00", "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 is not present in Jetty 11.0.31. The vulnerability (path disclosure via InvalidPathException in error responses when processing requests with invalid filesystem characters) was fixed by upstream commit ad4dceb1c08 (Issue #2560) which added exception sanitization to ResourceContentFactory.getContent(). This fix was already included in the upstream Jetty release that TuxCare onboar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12536" }, "impact_statement": "not_affected \u2014 CVE-2018-12536 is not present in Jetty 11.0.31. The vulnerability (path disclosure via InvalidPathException in error responses when processing requests with invalid filesystem characters) was fixed by upstream commit ad4dceb1c08 (Issue #2560) which added exception sanitization to ResourceContentFactory.getContent(). This fix was already included in the upstream Jetty release that TuxCare onboar..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2018-12538 affects version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2018-12538" }, "action_statement": "Vulnerability CVE-2018-12538 affects version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2018-12545 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Target version 11.0.31 is not affected. The fix for CVE-2018-12545 (limiting cumulative HTTP/2 SETTINGS keys to prevent DoS) was already present in upstream Jetty 11.0.0 (released 2020-12-02), well before TuxCare began maintaining this version. The fix was committed by upstream developer Simone Bordet on 2018-07-18. The vulnerable pattern (unbounded SETTINGS key processing) is absent because the upstream fix introduced a `maxKeys` limit (default 64) with ENHANCE_YOUR_CALM_ERROR enforcement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12545" }, "impact_statement": "Target version 11.0.31 is not affected. The fix for CVE-2018-12545 (limiting cumulative HTTP/2 SETTINGS keys to prevent DoS) was already present in upstream Jetty 11.0.0 (released 2020-12-02), well before TuxCare began maintaining this version. The fix was committed by upstream developer Simone Bordet on 2018-07-18. The vulnerable pattern (unbounded SETTINGS key processing) is absent because the upstream fix introduced a `maxKeys` limit (default 64) with ENHANCE_YOUR_CALM_ERROR enforcement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-10-31T16:17:57.385112+00:00", "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 XSS vulnerability in directory listings was fixed by upstream Jetty in commit 7b774d82e82 (April 2019, Issue #3549). This fix was already present in the upstream Jetty 11.0.26 release that TuxCare onboarded. The target at version 11.0.31.tuxcare0001 contains the complete fix: Resource.getFileName() properly decodes filenames, and deTag() sanitizes them before HTML rendering. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10241" }, "impact_statement": "not_affected \u2014 CVE-2019-10241 XSS vulnerability in directory listings was fixed by upstream Jetty in commit 7b774d82e82 (April 2019, Issue #3549). This fix was already present in the upstream Jetty 11.0.26 release that TuxCare onboarded. The target at version 11.0.31.tuxcare0001 contains the complete fix: Resource.getFileName() properly decodes filenames, and deTag() sanitizes them before HTML rendering. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2019-10246 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 is not present in Eclipse Jetty 11.0.31.tuxcare0001. The vulnerability allowed directory listings on Windows to expose fully qualified filesystem paths to remote clients. The upstream fix (commit 7b774d82e82 by Joakim Erdfelt, 2019-04-15) replaced the vulnerable getName() pattern with a new getFileName() method that extracts only the filename segment. This fix was already present...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10246" }, "impact_statement": "not_affected \u2014 CVE-2019-10246 is not present in Eclipse Jetty 11.0.31.tuxcare0001. The vulnerability allowed directory listings on Windows to expose fully qualified filesystem paths to remote clients. The upstream fix (commit 7b774d82e82 by Joakim Erdfelt, 2019-04-15) replaced the vulnerable getName() pattern with a new getFileName() method that extracts only the filename segment. This fix was already present..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-10-31T16:40:00.680954+00:00", "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 affects Jetty versions 9.4.16 and older where DefaultHandler reveals filesystem base resource paths in 404 error responses via context.toString(). The target (Jetty 11.0.31.tuxcare0001) is not affected because the upstream fix was already present in version 11.0.26 when TuxCare onboarded it. The vulnerable pattern (outputting context.toString() in error HTML) is absent from the c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10247" }, "impact_statement": "not_affected \u2014 CVE-2019-10247 affects Jetty versions 9.4.16 and older where DefaultHandler reveals filesystem base resource paths in 404 error responses via context.toString(). The target (Jetty 11.0.31.tuxcare0001) is not affected because the upstream fix was already present in version 11.0.26 when TuxCare onboarded it. The vulnerable pattern (outputting context.toString() in error HTML) is absent from the c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-02T19:18:00.143361+00:00", "status_notes": "Vulnerability CVE-2019-17632 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 affects Jetty 9.4.21-9.4.23 (Nov 2019) where exception messages in error responses were not HTML-escaped, enabling XSS attacks. The target is Jetty 11.0.31.tuxcare0001, a much newer version. The upstream fix (commits 9e40fc9a6fb and cf0df6e3ffd by Joakim Erdfelt in Nov 2019) is present in HEAD and predates TuxCare's first commit (5dc9759246d \"setup 11.0.26\"). Both patches are ver...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17632" }, "impact_statement": "not_affected \u2014 CVE-2019-17632 affects Jetty 9.4.21-9.4.23 (Nov 2019) where exception messages in error responses were not HTML-escaped, enabling XSS attacks. The target is Jetty 11.0.31.tuxcare0001, a much newer version. The upstream fix (commits 9e40fc9a6fb and cf0df6e3ffd by Joakim Erdfelt in Nov 2019) is present in HEAD and predates TuxCare's first commit (5dc9759246d \"setup 11.0.26\"). Both patches are ver..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2019-17638 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2019-17638 describes a double-release vulnerability in Jetty 9.4.27-9.4.29 where ByteBuffers are released twice during response header overflow, enabling cross-client data leakage. The target (Jetty 11.0.31) is NOT affected because the upstream fix (commit ff8ae56fa93 from 2020-06-03) was already present in the upstream release before TuxCare onboarded version 11.0.26. The current code properly nulls buffer references after release via dedicated releaseHeader() and releaseChunk() methods, preventing double-release. The fix is attributed to upstream author gregw@webtide.com, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17638" }, "impact_statement": "CVE-2019-17638 describes a double-release vulnerability in Jetty 9.4.27-9.4.29 where ByteBuffers are released twice during response header overflow, enabling cross-client data leakage. The target (Jetty 11.0.31) is NOT affected because the upstream fix (commit ff8ae56fa93 from 2020-06-03) was already present in the upstream release before TuxCare onboarded version 11.0.26. The current code properly nulls buffer references after release via dedicated releaseHeader() and releaseChunk() methods, preventing double-release. The fix is attributed to upstream author gregw@webtide.com, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-02T19:35:35.638333+00:00", "status_notes": "Vulnerability CVE-2020-27218 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 (GZIP request body inflation data injection vulnerability) is not present in Jetty 11.0.31.tuxcare0001. The fix was introduced by upstream Jetty developers in commit 14f94f738df and was included in Jetty 10.0.0 and all subsequent versions. The target version (11.0.31) already contains the complete fix, which includes the ensureConsumeAllOrNotPersistent() mechanism that either con...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27218" }, "impact_statement": "not_affected \u2014 CVE-2020-27218 (GZIP request body inflation data injection vulnerability) is not present in Jetty 11.0.31.tuxcare0001. The fix was introduced by upstream Jetty developers in commit 14f94f738df and was included in Jetty 10.0.0 and all subsequent versions. The target version (11.0.31) already contains the complete fix, which includes the ensureConsumeAllOrNotPersistent() mechanism that either con..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-02T19:28:51.823841+00:00", "status_notes": "Vulnerability CVE-2020-27223 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.31) is NOT affected by CVE-2020-27223. The vulnerability involved an inefficient O(n\u00b2) bubble-sort-like algorithm in QuotedQualityCSV.java that could cause denial of service when processing HTTP headers with many quality parameters. The fix (commit 10e531756b972162eed402c44d0244f7f6b85131) replaced this with an efficient O(n log n) comparator-based sort using J...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27223" }, "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.31) is NOT affected by CVE-2020-27223. The vulnerability involved an inefficient O(n\u00b2) bubble-sort-like algorithm in QuotedQualityCSV.java that could cause denial of service when processing HTTP headers with many quality parameters. The fix (commit 10e531756b972162eed402c44d0244f7f6b85131) replaced this with an efficient O(n log n) comparator-based sort using J..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-03T12:30:34.591989+00:00", "status_notes": "Vulnerability CVE-2021-28165 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2021-28165 does not affect Jetty 11.0.31. The vulnerability (CPU exhaustion from large TLS frames >17408 bytes causing infinite loop) was fixed by upstream Jetty developers in commits that shipped in Jetty 11.0.26, before TuxCare onboarded this version. The fix is present in the target code at jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java lines 756-760, where buffer space is checked before attempting further processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-28165" }, "impact_statement": "CVE-2021-28165 does not affect Jetty 11.0.31. The vulnerability (CPU exhaustion from large TLS frames >17408 bytes causing infinite loop) was fixed by upstream Jetty developers in commits that shipped in Jetty 11.0.26, before TuxCare onboarded this version. The fix is present in the target code at jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java lines 756-760, where buffer space is checked before attempting further processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-10-31T15:23:00.070442+00:00", "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2021-34428 is not present in the target. The vulnerability (session IDs remaining valid after invalidation when SessionListener.sessionDestroyed() throws an exception) was fixed in upstream commit 087f486b446 by Jan Bartel (janb@webtide.com) in May 2021. This fix was already included in the upstream Jetty 11.0.26 release that TuxCare onboarded (first TuxCare commit: 5dc9759246d \"setup 11.0....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-34428" }, "impact_statement": "not_affected \u2014 CVE-2021-34428 is not present in the target. The vulnerability (session IDs remaining valid after invalidation when SessionListener.sessionDestroyed() throws an exception) was fixed in upstream commit 087f486b446 by Jan Bartel (janb@webtide.com) in May 2021. This fix was already included in the upstream Jetty 11.0.26 release that TuxCare onboarded (first TuxCare commit: 5dc9759246d \"setup 11.0...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2022-2191 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2022-2191 describes a memory leak vulnerability in Jetty's SslConnection where ByteBuffers are not released when TLS processing encounters exceptions (e.g., expired client certificates during handshake). The upstream fix (commit 66de7ba6180) added discardInputBuffers() and discardEncryptedOutputBuffer() methods that clear and release buffers in exception handlers. This fix was authored by Ludovic Orban (lorban@bitronix.be) and shipped in upstream Jetty 11.0.26+. The target version 11.0.31.tuxcare0001 includes this upstream fix\u2014it was already present in the upstream release that TuxCare onboarded at commit 5dc9759246d. The vulnerable code pattern (missing buffer cleanup in error paths) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-2191" }, "impact_statement": "CVE-2022-2191 describes a memory leak vulnerability in Jetty's SslConnection where ByteBuffers are not released when TLS processing encounters exceptions (e.g., expired client certificates during handshake). The upstream fix (commit 66de7ba6180) added discardInputBuffers() and discardEncryptedOutputBuffer() methods that clear and release buffers in exception handlers. This fix was authored by Ludovic Orban (lorban@bitronix.be) and shipped in upstream Jetty 11.0.26+. The target version 11.0.31.tuxcare0001 includes this upstream fix\u2014it was already present in the upstream release that TuxCare onboarded at commit 5dc9759246d. The vulnerable code pattern (missing buffer cleanup in error paths) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-10-31T15:45:29.380963+00:00", "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26048 fix was already present in the upstream Jetty 11.0.31 release that TuxCare onboarded. The vulnerability affects Jetty versions before 11.0.14, and the target is version 11.0.31.tuxcare0001. The upstream fix (commit 622befbd0d5 from PR #9344) was merged on 2023-02-14 and is an ancestor of the first TuxCare commit in this branch, confirming it shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26048" }, "impact_statement": "not_affected \u2014 CVE-2023-26048 fix was already present in the upstream Jetty 11.0.31 release that TuxCare onboarded. The vulnerability affects Jetty versions before 11.0.14, and the target is version 11.0.31.tuxcare0001. The upstream fix (commit 622befbd0d5 from PR #9344) was merged on 2023-02-14 and is an ancestor of the first TuxCare commit in this branch, confirming it shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-10-31T15:17:00.108725+00:00", "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 11.0.31) is NOT affected by CVE-2023-26049. The vulnerability was fixed in upstream Jetty 11.0.15 (per CVE advisory), and TuxCare's version 11.0.31 includes this upstream fix. The fix commit (7b8c2c1bf081c7f408e5da3371c8c3c9802f09fd by simone.bordet@gmail.com) is an ancestor of TuxCare's first commit (5dc9759246d \"setup 11.0.26\"), meaning the fix was already present...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26049" }, "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.31) is NOT affected by CVE-2023-26049. The vulnerability was fixed in upstream Jetty 11.0.15 (per CVE advisory), and TuxCare's version 11.0.31 includes this upstream fix. The fix commit (7b8c2c1bf081c7f408e5da3371c8c3c9802f09fd by simone.bordet@gmail.com) is an ancestor of TuxCare's first commit (5dc9759246d \"setup 11.0.26\"), meaning the fix was already present..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-04T09:12:34.459172+00:00", "status_notes": "Vulnerability CVE-2024-13009 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 11.0.31 uses a fundamentally different architecture (ContentProducer pattern) than the vulnerable 9.4.x versions. The fix for CVE-2024-13009 (properly nulling content buffer references after gzip decompression failures) was built into the version 11 architecture from its creation in upstream commit 814dc69803f (2020-03-20). The AsyncContentProducer.failCurrentContent() method already calls content.failed() and nulls both _rawContent and _transformedContent, preventing the buffer reuse vulnerability. This fix shipped in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-13009" }, "impact_statement": "Version 11.0.31 uses a fundamentally different architecture (ContentProducer pattern) than the vulnerable 9.4.x versions. The fix for CVE-2024-13009 (properly nulling content buffer references after gzip decompression failures) was built into the version 11 architecture from its creation in upstream commit 814dc69803f (2020-03-20). The AsyncContentProducer.failCurrentContent() method already calls content.failed() and nulls both _rawContent and _transformedContent, preventing the buffer reuse vulnerability. This fix shipped in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-11-04T09:14:29.621948+00:00", "status_notes": "Vulnerability CVE-2024-7708 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2024-7708 is NOT present in target version 11.0.31. The upstream fix (commit 8259eabbc70 by Simone Bordet) was already included in the base release before TuxCare began maintaining this version. The fix properly releases request buffers when read operations return zero or negative bytes (lines 385, 401 in HttpConnection.java), preventing the memory leak vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-7708" }, "impact_statement": "CVE-2024-7708 is NOT present in target version 11.0.31. The upstream fix (commit 8259eabbc70 by Simone Bordet) was already included in the base release before TuxCare began maintaining this version. The fix properly releases request buffers when read operations return zero or negative bytes (lines 385, 401 in HttpConnection.java), preventing the memory leak vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8184 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-8184" }, "impact_statement": "Version 11.0.28 is not vulnerable. Summary: The target repository already has the security fix for CVE-2024-8184 applied. The code uses atomic compute() operations with reference counting and proper cleanup mechanisms to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10051 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Jetty 11.0.30 is outside the affected range (12.0.0\u201312.0.35 and 12.1.0\u201312.1.9). CVE-2026-10051 affects the Jetty 12 lifecycle where connection-scoped trailer state can survive parser reuse. This code path is absent in Jetty 11.0.30, where the HTTP channel clears its trailer state during request recycle before the parser is reused. Therefore, trailer state cannot leak between requests in this version.", "vulnerability": { "name": "CVE-2026-10051" }, "impact_statement": "Jetty 11.0.30 is outside the affected range (12.0.0\u201312.0.35 and 12.1.0\u201312.1.9). CVE-2026-10051 affects the Jetty 12 lifecycle where connection-scoped trailer state can survive parser reuse. This code path is absent in Jetty 11.0.30, where the HTTP channel clears its trailer state during request recycle before the parser is reused. Therefore, trailer state cannot leak between requests in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1605" }, "impact_statement": "Version 11.0.28 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2026-1605. The vulnerability affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.0.5), while the target is running Jetty 11.0.28.tuxcare0001, which uses a different architecture for request decompression that does not exhibit this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@11.0.31.tuxcare0001" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-6790" } } ] }