{
  "@id": "urn:uuid:39ab00e7-b4e3-4935-b282-9235f5d1d309",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 41,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:46:34.171368+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:06:35.446673+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 affects Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3 due to predictable session ID generation using insecure java.util.Random. The target (Jetty 12.0.22) uses java.security.SecureRandom by default for session ID generation (DefaultSessionIdManager.java:355), with fallback to insecure Random only on exception. This defense was already present in upstream Jetty 12.0.22...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 affects Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3 due to predictable session ID generation using insecure java.util.Random. The target (Jetty 12.0.22) uses java.security.SecureRandom by default for session ID generation (DefaultSessionIdManager.java:355), with fallback to insecure Random only on exception. This defense was already present in upstream Jetty 12.0.22..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "action_statement": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 describes a hash collision DOS vulnerability in Jetty 8.1.0.RC2 and earlier where unlimited form parameters could trigger O(n\u00b2) performance degradation. The target repository (Jetty 12.0.22-tuxcare.1) is NOT vulnerable because the fix was already present in the upstream Jetty 12.0.22 release that TuxCare onboarded. The fix (commit 085c79d7d6c from Dec 2011, authored by upstream ma...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-4461 describes a hash collision DOS vulnerability in Jetty 8.1.0.RC2 and earlier where unlimited form parameters could trigger O(n\u00b2) performance degradation. The target repository (Jetty 12.0.22-tuxcare.1) is NOT vulnerable because the fix was already present in the upstream Jetty 12.0.22 release that TuxCare onboarded. The fix (commit 085c79d7d6c from Dec 2011, authored by upstream ma..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:46:34.171368+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 12.0.22 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 12.0.22 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:28:17.034118+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affected Jetty 9.3.0-9.3.8 on Windows, allowing attackers to bypass security constraints via path normalization issues with escaped characters (e.g., \"aa./foo.txt\" normalized to \"aa/foo.txt\" by Windows JVM). The fix was committed in May 2016 (commit 97af3d663fd by upstream maintainer Joakim Erdfelt) and shipped in Jetty 9.3.9. This fix has been carried forward through all subseque...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affected Jetty 9.3.0-9.3.8 on Windows, allowing attackers to bypass security constraints via path normalization issues with escaped characters (e.g., \"aa./foo.txt\" normalized to \"aa/foo.txt\" by Windows JVM). The fix was committed in May 2016 (commit 97af3d663fd by upstream maintainer Joakim Erdfelt) and shipped in Jetty 9.3.9. This fix has been carried forward through all subseque..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:41:05.137822+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. CVE-2017-7656 (HTTP Request Smuggling via conflicting Content-Length/Transfer-Encoding headers) is NOT present in Jetty 12.0.22-tuxcare.1. The upstream fix from commit a285deea42f (May 17, 2018, by Greg Wilkins) was already included in the Jetty 12.0.22 release that TuxCare onboarded. The target code implements the required defense: it tracks _hasContentLength and _hasTransferEncoding flags, and with the default RFC7230 compliance mode, throws BadMessageException when multiple Content-Length headers are received OR when both Content-Length and Transfer-Encoding headers are present. This prevents the malicious INPUT (requests with conflicting content-length specifications) from reaching the GOAL (differential interpretation enabling request smuggling and cache poisoning).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "CVE-2017-7656 (HTTP Request Smuggling via conflicting Content-Length/Transfer-Encoding headers) is NOT present in Jetty 12.0.22-tuxcare.1. The upstream fix from commit a285deea42f (May 17, 2018, by Greg Wilkins) was already included in the Jetty 12.0.22 release that TuxCare onboarded. The target code implements the required defense: it tracks _hasContentLength and _hasTransferEncoding flags, and with the default RFC7230 compliance mode, throws BadMessageException when multiple Content-Length headers are received OR when both Content-Length and Transfer-Encoding headers are present. This prevents the malicious INPUT (requests with conflicting content-length specifications) from reaching the GOAL (differential interpretation enabling request smuggling and cache poisoning).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:45:34.333226+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. CVE-2017-7657 (integer overflow in HTTP chunked transfer-encoding parsing) is not present in the target. The vulnerability was fixed by upstream Jetty developer Greg Wilkins in commit a285deea42f (May 2018), which introduced MAX_CHUNK_LENGTH validation to prevent integer overflow during chunk size parsing. This fix was already present in upstream version 12.0.22 when TuxCare onboarded it (commit 11545e1f96a). The current code uses a different protection mechanism (16-digit limit + overflow detection on long type) introduced by a later CVE-2026-2332 backport, but the original vulnerability pattern was eliminated by the upstream fix that shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "impact_statement": "CVE-2017-7657 (integer overflow in HTTP chunked transfer-encoding parsing) is not present in the target. The vulnerability was fixed by upstream Jetty developer Greg Wilkins in commit a285deea42f (May 2018), which introduced MAX_CHUNK_LENGTH validation to prevent integer overflow during chunk size parsing. This fix was already present in upstream version 12.0.22 when TuxCare onboarded it (commit 11545e1f96a). The current code uses a different protection mechanism (16-digit limit + overflow detection on long type) introduced by a later CVE-2026-2332 backport, but the original vulnerability pattern was eliminated by the upstream fix that shipped in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. Target Jetty 12.0.22 is NOT AFFECTED by CVE-2017-7658. The vulnerability (HTTP Request Smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked) was fixed in upstream commit a285deea42f by Greg Wilkins (gregw@webtide.com) on 2018-05-17, which was already included in the Jetty 12.0.22 release that TuxCare onboarded. The defense is present in HttpParser.java:1111-1159, which tracks _hasContentLength boolean and rejects ambiguous body length specifications with BadMessageException, preventing request body content from being parsed as a separate pipelined request.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "Target Jetty 12.0.22 is NOT AFFECTED by CVE-2017-7658. The vulnerability (HTTP Request Smuggling via multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked) was fixed in upstream commit a285deea42f by Greg Wilkins (gregw@webtide.com) on 2018-05-17, which was already included in the Jetty 12.0.22 release that TuxCare onboarded. The defense is present in HttpParser.java:1111-1159, which tracks _hasContentLength boolean and rejects ambiguous body length specifications with BadMessageException, preventing request body content from being parsed as a separate pipelined request.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:29:43.002778+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. CVE-2017-9735 timing channel vulnerability is not present in Jetty 12.0.22. The fix was already included in the upstream release 12.0.22 before TuxCare onboarded it. The target contains constant-time comparison methods (stringEquals/byteEquals) that prevent timing attacks by always looping for the full length of the unknown credential using modulo arithmetic, making password content and length inference impossible via timing measurements.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 timing channel vulnerability is not present in Jetty 12.0.22. The fix was already included in the upstream release 12.0.22 before TuxCare onboarded it. The target contains constant-time comparison methods (stringEquals/byteEquals) that prevent timing attacks by always looping for the full length of the unknown credential using modulo arithmetic, making password content and length inference impossible via timing measurements.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T18:02:30.639285+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 is not present in Jetty 12.0.22-tuxcare.1. The vulnerability (path disclosure through InvalidPathException) was fixed in upstream Jetty before version 12.0.22 was released. The fix wraps all exceptions in ResourceHttpContentFactory.getContent() to sanitize error messages, preventing full filesystem paths from being leaked. The fix commit (abc40afd890) by upstream author lachlan@w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 is not present in Jetty 12.0.22-tuxcare.1. The vulnerability (path disclosure through InvalidPathException) was fixed in upstream Jetty before version 12.0.22 was released. The fix wraps all exceptions in ResourceHttpContentFactory.getContent() to sanitize error messages, preventing full filesystem paths from being leaked. The fix commit (abc40afd890) by upstream author lachlan@w..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. CVE-2018-12545 affects Eclipse Jetty 9.3.x and 9.4.x with unbounded HTTP/2 SETTINGS frame processing leading to DoS. The target repository (Jetty 12.0.22-tuxcare.1) contains upstream fixes (commits 9eca404 and cfe1baa) that add maxSettingsKeys limiting (default 64) and rate control. These fixes shipped in upstream Jetty 12.0.22 before TuxCare onboarding (commit 11545e1f96a). The vulnerable pattern (unbounded settings processing) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 affects Eclipse Jetty 9.3.x and 9.4.x with unbounded HTTP/2 SETTINGS frame processing leading to DoS. The target repository (Jetty 12.0.22-tuxcare.1) contains upstream fixes (commits 9eca404 and cfe1baa) that add maxSettingsKeys limiting (default 64) and rate control. These fixes shipped in upstream Jetty 12.0.22 before TuxCare onboarding (commit 11545e1f96a). The vulnerable pattern (unbounded settings processing) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T16:03:05.849088+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 affects Eclipse Jetty's directory listing functionality where specially formatted URLs could trigger XSS. The vulnerability existed when full resource paths (which could contain malicious content) were used directly in HTML output. The upstream fix introduced a `getFileName()` method to extract only the filename portion. Target version 12.0.22-tuxcare.1 contains the upstream fix ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 affects Eclipse Jetty's directory listing functionality where specially formatted URLs could trigger XSS. The vulnerability existed when full resource paths (which could contain malicious content) were used directly in HTML output. The upstream fix introduced a `getFileName()` method to extract only the filename portion. Target version 12.0.22-tuxcare.1 contains the upstream fix ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 affects Jetty 9.2.27, 9.3.26, and 9.4.16 on Windows, exposing fully qualified directory paths in directory listings. The target (Jetty 12.0.22-tuxcare.1) is not affected because the upstream fix (commit 7b774d82e82, April 2019) shipped in release 12.0.22 before TuxCare onboarded it. Jetty 12 refactored directory listing into ResourceListing.getAsXHTML() which uses Resource.getFil...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 affects Jetty 9.2.27, 9.3.26, and 9.4.16 on Windows, exposing fully qualified directory paths in directory listings. The target (Jetty 12.0.22-tuxcare.1) is not affected because the upstream fix (commit 7b774d82e82, April 2019) shipped in release 12.0.22 before TuxCare onboarded it. Jetty 12 refactored directory listing into ResourceListing.getAsXHTML() which uses Resource.getFil..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T16:27:26.409965+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 is not present in Jetty 12.0.22-tuxcare.1. The vulnerability involved DefaultHandler revealing filesystem base resource paths in 404 error responses via context.toString(). The upstream fix (commit 04c994712c0) removed this disclosure and was applied in 2019. Jetty 12.0.22, released years later, already contained the fix when TuxCare onboarded it. The vulnerable code pattern is c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 is not present in Jetty 12.0.22-tuxcare.1. The vulnerability involved DefaultHandler revealing filesystem base resource paths in 404 error responses via context.toString(). The upstream fix (commit 04c994712c0) removed this disclosure and was applied in 2019. Jetty 12.0.22, released years later, already contained the fix when TuxCare onboarded it. The vulnerable code pattern is c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T19:15:55.561862+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 is NOT present in target jetty.project 12.0.22-tuxcare.1. The vulnerability (unescaped exception messages in error responses enabling XSS) was fixed by upstream commit cf0df6e3ffd, which was included in the upstream Jetty 12.0.22 release before TuxCare onboarded it. All three ErrorHandler implementations (jetty-core, jetty-ee9, jetty-ee10) sanitize exception messages via StringUt...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 is NOT present in target jetty.project 12.0.22-tuxcare.1. The vulnerability (unescaped exception messages in error responses enabling XSS) was fixed by upstream commit cf0df6e3ffd, which was included in the upstream Jetty 12.0.22 release before TuxCare onboarded it. All three ErrorHandler implementations (jetty-core, jetty-ee9, jetty-ee10) sanitize exception messages via StringUt..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. The target (Jetty 12.0.22-tuxcare.1) is NOT vulnerable to CVE-2019-17638. The vulnerability (double-release of response header ByteBuffer leading to cross-client data leakage) was fixed in upstream commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba (June 2020) authored by Greg Wilkins (gregw@webtide.com). This fix was included in the upstream Jetty 12.0.22 release that TuxCare onboarded. The target code properly prevents double-release by not releasing the header buffer before throwing an exception when headers exceed the maximum allowed size.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "The target (Jetty 12.0.22-tuxcare.1) is NOT vulnerable to CVE-2019-17638. The vulnerability (double-release of response header ByteBuffer leading to cross-client data leakage) was fixed in upstream commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba (June 2020) authored by Greg Wilkins (gregw@webtide.com). This fix was included in the upstream Jetty 12.0.22 release that TuxCare onboarded. The target code properly prevents double-release by not releasing the header buffer before throwing an exception when headers exceed the maximum allowed size.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T19:32:48.041601+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 describes a vulnerability where unconsumed GZIP-compressed request body content persists on persistent HTTP connections and contaminates subsequent requests. The target Jetty 12.0.22-tuxcare.1 contains the complete upstream fix (commit 14f94f738df by Greg Wilkins) that was already present in the Jetty 12.0.22 release before TuxCare onboarded it. The fix adds consumeAll() and ensu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 describes a vulnerability where unconsumed GZIP-compressed request body content persists on persistent HTTP connections and contaminates subsequent requests. The target Jetty 12.0.22-tuxcare.1 contains the complete upstream fix (commit 14f94f738df by Greg Wilkins) that was already present in the Jetty 12.0.22 release before TuxCare onboarded it. The fix adds consumeAll() and ensu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T19:26:20.372837+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 12.0.22 is not affected by CVE-2020-27223. The vulnerable O(n\u00b2) bubble-sort algorithm in QuotedQualityCSV has been replaced with an efficient O(n log n) comparator-based sort. The fix (commit 10e531756b9) was included in the upstream Jetty release 12.0.22, which TuxCare subsequently onboarded. The vulnerable code pattern that caused DoS through excessive CPU usage when parsing qu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 Target version 12.0.22 is not affected by CVE-2020-27223. The vulnerable O(n\u00b2) bubble-sort algorithm in QuotedQualityCSV has been replaced with an efficient O(n log n) comparator-based sort. The fix (commit 10e531756b9) was included in the upstream Jetty release 12.0.22, which TuxCare subsequently onboarded. The vulnerable code pattern that caused DoS through excessive CPU usage when parsing qu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:24:19.585233+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. The target Jetty version 12.0.22-tuxcare.1 is not affected by CVE-2021-28165. The vulnerability involved incorrect handling of oversized TLS frames (>17408 bytes) causing infinite retry loops and CPU exhaustion when the encrypted input buffer filled without proper consumption. The fix was authored by upstream Jetty developer Simone Bordet (commit 039c7386d0f3, March 22, 2021) and shipped in the upstream Jetty 12.0.22 release before TuxCare onboarded it. The target code implements the required defense: it checks if the encrypted input buffer has no remaining space (line 778) BEFORE attempting further fill operations (line 785), preventing the infinite loop that caused CPU exhaustion. An additional performance optimization (commit 96f707f74b9 by Greg Wilkins) adds buffer compaction before the space check, making the defense even more robust.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "The target Jetty version 12.0.22-tuxcare.1 is not affected by CVE-2021-28165. The vulnerability involved incorrect handling of oversized TLS frames (>17408 bytes) causing infinite retry loops and CPU exhaustion when the encrypted input buffer filled without proper consumption. The fix was authored by upstream Jetty developer Simone Bordet (commit 039c7386d0f3, March 22, 2021) and shipped in the upstream Jetty 12.0.22 release before TuxCare onboarded it. The target code implements the required defense: it checks if the encrypted input buffer has no remaining space (line 778) BEFORE attempting further fill operations (line 785), preventing the infinite loop that caused CPU exhaustion. An additional performance optimization (commit 96f707f74b9 by Greg Wilkins) adds buffer compaction before the space check, making the defense even more robust.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T15:22:00.101796+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2021-34428 is NOT present in Jetty 12.0.22-tuxcare.1. The vulnerability concerned session ID invalidation failure when SessionListener#sessionDestroyed() throws an exception. The target code contains the upstream fix: session listener calls are wrapped in try-catch (ManagedSession.java:638-646), and session ID manager invalidation is executed in a finally block (lines 647-654), ensuring inv...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34428 is NOT present in Jetty 12.0.22-tuxcare.1. The vulnerability concerned session ID invalidation failure when SessionListener#sessionDestroyed() throws an exception. The target code contains the upstream fix: session listener calls are wrapped in try-catch (ManagedSession.java:638-646), and session ID manager invalidation is executed in a finally block (lines 647-654), ensuring inv..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. The target (Jetty 12.0.22) is not affected by CVE-2022-2191. The vulnerability was a memory leak caused by unreleased ByteBuffers in error code paths during TLS handshake processing in SslConnection. The upstream fix (commit 66de7ba6180) added explicit buffer cleanup (discardInputBuffers() and discardEncryptedOutputBuffer()) in exception handlers. This fix was already present in upstream Jetty 12.0.22 before TuxCare onboarded the version, as confirmed by the fix commit being an ancestor of the first TuxCare commit (11545e1f96a \"Onboard version 12.0.22\"). The fix author (lorban@bitronix.be) is an upstream Jetty developer, not a TuxCare engineer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "The target (Jetty 12.0.22) is not affected by CVE-2022-2191. The vulnerability was a memory leak caused by unreleased ByteBuffers in error code paths during TLS handshake processing in SslConnection. The upstream fix (commit 66de7ba6180) added explicit buffer cleanup (discardInputBuffers() and discardEncryptedOutputBuffer()) in exception handlers. This fix was already present in upstream Jetty 12.0.22 before TuxCare onboarded the version, as confirmed by the fix commit being an ancestor of the first TuxCare commit (11545e1f96a \"Onboard version 12.0.22\"). The fix author (lorban@bitronix.be) is an upstream Jetty developer, not a TuxCare engineer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10), NVD (>= 10.0.0, <= 10.0.9; >= 11.0.0, <= 11.0.9), Snyk (>= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10; >= 10.0.0, < 10.0.10; >= 11.0.0, < 11.0.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T14:17:46.916788+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. Version 12.0.22 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-qw69-rqj8-6qw8 (affected below 11.0.14), NVD (affected below 11.0.14), CVE record (affected below 11.0.14), Snyk (affected below 12.0.0.beta0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "Version 12.0.22 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-qw69-rqj8-6qw8 (affected below 11.0.14), NVD (affected below 11.0.14), CVE record (affected below 11.0.14), Snyk (affected below 12.0.0.beta0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T15:07:00.117911+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values with semicolons) is NOT present in Jetty 12.0.22. The upstream fix (commit 7b8c2c1bf081c7f4) was already included in the upstream Jetty 12.0.22 release before TuxCare onboarded it. The default RFC6265CookieParser properly terminates quoted cookie values and rejects semicolons inside quotes as INVALID_COOKIES. The deprecated CookieCutter legacy ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values with semicolons) is NOT present in Jetty 12.0.22. The upstream fix (commit 7b8c2c1bf081c7f4) was already included in the upstream Jetty 12.0.22 release before TuxCare onboarded it. The default RFC6265CookieParser properly terminates quoted cookie values and rejects semicolons inside quotes as INVALID_COOKIES. The deprecated CookieCutter legacy ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. Jetty 12.0.22 uses a fundamentally different architecture from the affected 9.4.x versions. The vulnerability pattern (stale content buffer references persisting across requests) does not exist in 12.0.x because GzipRequest and GzipTransformer instances are created per-request and not shared. The malformed gzip input is received, but no code path connects it to the Goal (buffer data from failed request accessible in subsequent request) due to per-request object isolation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "Jetty 12.0.22 uses a fundamentally different architecture from the affected 9.4.x versions. The vulnerability pattern (stale content buffer references persisting across requests) does not exist in 12.0.x because GzipRequest and GzipTransformer instances are created per-request and not shared. The malformed gzip input is received, but no code path connects it to the Goal (buffer data from failed request accessible in subsequent request) due to per-request object isolation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. CVE-2024-7708 affects Jetty 10.0.0-10.0.22 and 11.0.0-11.0.22 (memory leak when reading 0 bytes from request body). The target is Jetty 12.0.22, which is NOT listed as affected in the CVE. Analysis confirms Jetty 12 uses a fundamentally different architecture where buffer lifecycle management occurs at the caller level rather than inside fillRequestBuffer(). All code paths that call fillRequestBuffer() explicitly release buffers when fill returns 0 or negative bytes, preventing the memory leak. The vulnerable pattern from Jetty 10/11 does not exist in Jetty 12's design.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23).",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "CVE-2024-7708 affects Jetty 10.0.0-10.0.22 and 11.0.0-11.0.22 (memory leak when reading 0 bytes from request body). The target is Jetty 12.0.22, which is NOT listed as affected in the CVE. Analysis confirms Jetty 12 uses a fundamentally different architecture where buffer lifecycle management occurs at the caller level rather than inside fillRequestBuffer(). All code paths that call fillRequestBuffer() explicitly release buffers when fill returns 0 or negative bytes, preventing the memory leak. The vulnerable pattern from Jetty 10/11 does not exist in Jetty 12's design.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), NVD (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), cve.org (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23), Snyk (>= 10.0.7, < 10.0.23; >= 11.0.7, < 11.0.23)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T19:11:20.675494+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 12.0.22) is not affected by CVE-2024-8184. The vulnerability was fixed in upstream commit 45e474b7d53 (PR #11723) authored by Ludovic Orban on 2024-05-02, which was already included in the upstream 12.0.22 release that TuxCare onboarded on 2026-10-08. The fix eliminated a TOCTOU race condition in ThreadLimitHandler.getRemote() by replacing unsafe get-then-putIfAbsen...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 12.0.22) is not affected by CVE-2024-8184. The vulnerability was fixed in upstream commit 45e474b7d53 (PR #11723) authored by Ludovic Orban on 2024-05-02, which was already included in the upstream 12.0.22 release that TuxCare onboarded on 2026-10-08. The fix eliminated a TOCTOU race condition in ThreadLimitHandler.getRemote() by replacing unsafe get-then-putIfAbsen..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "action_statement": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "action_statement": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-18660"
      },
      "action_statement": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:18:00.127363+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    }
  ]
}