{ "@id": "urn:uuid:3644bdef-c847-4f49-858f-5ffebd96476b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 16, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:05:51.407283+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-11-03T15:04:56.336983+00:00", "status_notes": "Vulnerability CVE-2006-6969 does not affect version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 describes Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3 using predictable java.util.Random for session ID generation. The target version 7.6.0.v20120127 is NOT affected - it uses SecureRandom by default for cryptographically secure session IDs. The fix was applied by upstream Jetty in commit c3275730b91 (April 2010, JETTY-1202) and was already present in the 7.6.0.v20...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2006-6969" }, "impact_statement": "not_affected \u2014 CVE-2006-6969 describes Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3 using predictable java.util.Random for session ID generation. The target version 7.6.0.v20120127 is NOT affected - it uses SecureRandom by default for cryptographically secure session IDs. The fix was applied by upstream Jetty in commit c3275730b91 (April 2010, JETTY-1202) and was already present in the 7.6.0.v20..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2011-4461 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2011-4461" }, "action_statement": "Vulnerability CVE-2011-4461 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2015-2080 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2015-2080" }, "action_statement": "Vulnerability CVE-2015-2080 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-11-05T11:08:46.443689+00:00", "status_notes": "Vulnerability CVE-2016-4800 does not affect version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server. Jetty 7.6.0.v20120127 is not affected. CVE-2016-4800 affects only Eclipse Jetty 9.3.0 through 9.3.8 (upstream advisory ocert-2016-001 / GHSA-872g-2h8h-362q: affected >= 9.3.0, <= 9.3.8, fixed in 9.3.9 by commit 97af3d663fd \"Improve Resource.getAlias() checks on Windows\"). The flaw is in the Windows path-alias check of PathResource, which became the default file Resource in 9.3.0. Jetty 7.6 has no PathResource class at all: Resource.newResource() always creates FileResource for file: URLs, so the vulnerable code is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-4800" }, "impact_statement": "Jetty 7.6.0.v20120127 is not affected. CVE-2016-4800 affects only Eclipse Jetty 9.3.0 through 9.3.8 (upstream advisory ocert-2016-001 / GHSA-872g-2h8h-362q: affected >= 9.3.0, <= 9.3.8, fixed in 9.3.9 by commit 97af3d663fd \"Improve Resource.getAlias() checks on Windows\"). The flaw is in the Windows path-alias check of PathResource, which became the default file Resource in 9.3.0. Jetty 7.6 has no PathResource class at all: Resource.newResource() always creates FileResource for file: URLs, so the vulnerable code is not present." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-7656 is fixed in version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-7656" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-7657 is fixed in version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-7657" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-7658 is fixed in version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-7658" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2017-9735 is fixed in version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2017-9735" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-12536 does not affect version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 is specific to java.nio.file.InvalidPathException revealing full filesystem paths in Jetty 9.x when malformed paths trigger exceptions. The target version (Jetty 7.6.0.v20120127) targets Java 5 and uses the java.io.File API exclusively, not java.nio.file.Path. InvalidPathException was introduced in Java 7 NIO.2 and does not exist in Java 5. The vulnerable code pattern (PathResour...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2018-12536" }, "impact_statement": "not_affected \u2014 CVE-2018-12536 is specific to java.nio.file.InvalidPathException revealing full filesystem paths in Jetty 9.x when malformed paths trigger exceptions. The target version (Jetty 7.6.0.v20120127) targets Java 5 and uses the java.io.File API exclusively, not java.nio.file.Path. InvalidPathException was introduced in Java 7 NIO.2 and does not exist in Java 5. The vulnerable code pattern (PathResour..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-12538 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2018-12538" }, "action_statement": "Vulnerability CVE-2018-12538 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-12545 does not affect version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server. Jetty 7.6.0.v20120127 is not affected by CVE-2018-12545. This version predates HTTP/2 standardization by over 3 years (released January 2012, HTTP/2 standardized May 2015) and contains no HTTP/2 protocol implementation. The vulnerability requires HTTP/2 SETTINGS frame processing capability, which does not exist in this version. The CVE explicitly targets versions 9.3.x and 9.4.x where HTTP/2 support was introduced. Comprehensive code search found no HTTP/2-related modules, classes, or frame handling logic.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12545" }, "impact_statement": "Jetty 7.6.0.v20120127 is not affected by CVE-2018-12545. This version predates HTTP/2 standardization by over 3 years (released January 2012, HTTP/2 standardized May 2015) and contains no HTTP/2 protocol implementation. The vulnerability requires HTTP/2 SETTINGS frame processing capability, which does not exist in this version. The CVE explicitly targets versions 9.3.x and 9.4.x where HTTP/2 support was introduced. Comprehensive code search found no HTTP/2-related modules, classes, or frame handling logic." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-10241 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2019-10241" }, "action_statement": "Vulnerability CVE-2019-10241 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-10246 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2019-10246" }, "action_statement": "Vulnerability CVE-2019-10246 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-10247 is fixed in version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2019-10247" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-11-02T19:15:00.519823+00:00", "status_notes": "Vulnerability CVE-2019-17632 does not affect version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 7.6.0.v20120127 is NOT AFFECTED by CVE-2019-17632. The vulnerable pattern (unescaped exception messages in error page stacktraces) was never present in this version. The fix was applied to the upstream Jetty codebase in October 2009 (commit b5d16898e5af by Greg Wilkins), 10 years before CVE-2019-17632 was discovered. Version 7.6.0, released in January 2012, shipped with this fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17632" }, "impact_statement": "not_affected \u2014 Target version 7.6.0.v20120127 is NOT AFFECTED by CVE-2019-17632. The vulnerable pattern (unescaped exception messages in error page stacktraces) was never present in this version. The fix was applied to the upstream Jetty codebase in October 2009 (commit b5d16898e5af by Greg Wilkins), 10 years before CVE-2019-17632 was discovered. Version 7.6.0, released in January 2012, shipped with this fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-17638 does not affect version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server. Version 7.6.0.v20120127 is NOT AFFECTED by CVE-2019-17638. The target uses a fundamentally different architecture (Buffer/Buffers interface from 2012) with built-in atomic return-and-null buffer management, preventing the double-release vulnerability that was introduced in version 9.4.27-9.4.29 (2020) when the codebase was refactored to use ByteBuffer/ByteBufferPool. The dangerous operation (buffer pool double-release leading to cross-client data exposure) cannot be reached in version 7.6.0's architecture. The CVE-affected versions (9.4.27.v20200227 to 9.4.29.v20200521) are from 8 years after this target version was released.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17638" }, "impact_statement": "Version 7.6.0.v20120127 is NOT AFFECTED by CVE-2019-17638. The target uses a fundamentally different architecture (Buffer/Buffers interface from 2012) with built-in atomic return-and-null buffer management, preventing the double-release vulnerability that was introduced in version 9.4.27-9.4.29 (2020) when the codebase was refactored to use ByteBuffer/ByteBufferPool. The dangerous operation (buffer pool double-release leading to cross-client data exposure) cannot be reached in version 7.6.0's architecture. The CVE-affected versions (9.4.27.v20200227 to 9.4.29.v20200521) are from 8 years after this target version was released." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-27218 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2020-27218" }, "action_statement": "Vulnerability CVE-2020-27218 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-11-09T13:55:55.755322+00:00", "status_notes": "Vulnerability CVE-2020-27223 does not affect version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server. Prechecker: no vulnerable code from the patch was found, and none of the identifiers of the vulnerable code exist in this version. Advisories: GitHub, NVD and Snyk list only newer lines as affected, so this version is older; the cve.org (Eclipse) record reads as affected only because its range has no lower end.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-27223" }, "impact_statement": "Prechecker: no vulnerable code from the patch was found, and none of the identifiers of the vulnerable code exist in this version. Advisories: GitHub, NVD and Snyk list only newer lines as affected, so this version is older; the cve.org (Eclipse) record reads as affected only because its range has no lower end." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-28165 is fixed in version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2021-28165" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-34428 does not affect version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server. Version 7.6.0.v20120127 is not vulnerable. Summary: The target repository (Jetty 7.6.0.v20120127) is NOT vulnerable to CVE-2021-34428. While the CVE affects versions <= 9.4.40, <= 10.0.2, <= 11.0.2, the vulnerability is specific to the code architecture introduced in Jetty 9.x onwards. Version 7.6.0 uses the older AbstractSessionManager architecture where invalidateAll() is called BEFORE sessionDestroyed() listeners, ensuring the session ID is properly invalidated even when l [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-34428" }, "impact_statement": "Version 7.6.0.v20120127 is not vulnerable. Summary: The target repository (Jetty 7.6.0.v20120127) is NOT vulnerable to CVE-2021-34428. While the CVE affects versions <= 9.4.40, <= 10.0.2, <= 11.0.2, the vulnerability is specific to the code architecture introduced in Jetty 9.x onwards. Version 7.6.0 uses the older AbstractSessionManager architecture where invalidateAll() is called BEFORE sessionDestroyed() listeners, ensuring the session ID is properly invalidated even when l [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-11-09T20:55:00.104909+00:00", "status_notes": "Vulnerability CVE-2022-2191 does not affect version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The records describe configured-pool leaks in Jetty 10.0.0\u201310.0.9 and 11.0.0\u201311.0.9 (cve.json:1). TLS processing is reachable through the server connector, which constructs this version\u2019s `SslConnection` (SslSelectChannelConnector.java:547). Its three SSL buffers are `IndirectNIOBuffer` objects backed by heap byte arrays (SslConnection.java:75, IndirectNIOBuffer.java:24). Allocation clears the thread-local cache slot, while release caches buffers only when all three are empty; therefore the current run\u2019s claim that finally blocks always return buffers is too broad (SslConnection.java:139, SslConnection.java:156).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2022-2191" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The records describe configured-pool leaks in Jetty 10.0.0\u201310.0.9 and 11.0.0\u201311.0.9 (cve.json:1). TLS processing is reachable through the server connector, which constructs this version\u2019s `SslConnection` (SslSelectChannelConnector.java:547). Its three SSL buffers are `IndirectNIOBuffer` objects backed by heap byte arrays (SslConnection.java:75, IndirectNIOBuffer.java:24). Allocation clears the thread-local cache slot, while release caches buffers only when all three are empty; therefore the current run\u2019s claim that finally blocks always return buffers is too broad (SslConnection.java:139, SslConnection.java:156)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-26048 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2023-26048" }, "action_statement": "Vulnerability CVE-2023-26048 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-26049 is fixed in version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2023-26049" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-13009 does not affect version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server. CVE-2024-13009 does not affect Jetty version 7.6.0.v20120127. The vulnerability requires gzip request body decompression with a content interceptor system and buffer queue management (the `_content` field in HttpInput). Version 7.6.0 predates this architecture entirely: its HttpInput (73 lines) is a simple wrapper around HttpParser.blockForContent() with no content queue, no interceptor mechanism, and no server-side request body gzip decompression capability. The vulnerable code pattern was introduced in later 9.4.x versions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-13009" }, "impact_statement": "CVE-2024-13009 does not affect Jetty version 7.6.0.v20120127. The vulnerability requires gzip request body decompression with a content interceptor system and buffer queue management (the `_content` field in HttpInput). Version 7.6.0 predates this architecture entirely: its HttpInput (73 lines) is a simple wrapper around HttpParser.blockForContent() with no content queue, no interceptor mechanism, and no server-side request body gzip decompression capability. The vulnerable code pattern was introduced in later 9.4.x versions." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-11-06T17:20:00.095414+00:00", "status_notes": "Vulnerability CVE-2024-7708 does not affect version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 7.6.0.v20120127 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-9299-c6m4-mjhc (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-7708" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 7.6.0.v20120127 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-9299-c6m4-mjhc (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8184 does not affect version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server. Version 7.6.0.v20120127 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2024-8184. The ThreadLimitHandler class, which contains the vulnerability, does not exist in this version of Jetty (7.6.0.v20120127 from January 2012). ThreadLimitHandler was introduced in later versions of Jetty. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-8184" }, "impact_statement": "Version 7.6.0.v20120127 is not vulnerable. Summary: Target repository is NOT vulnerable to CVE-2024-8184. The ThreadLimitHandler class, which contains the vulnerability, does not exist in this version of Jetty (7.6.0.v20120127 from January 2012). ThreadLimitHandler was introduced in later versions of Jetty. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10051 does not affect version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 7.6.0.v20120127 does not implement HTTP trailer parsing. The CVE-2026-10051 vulnerability concerns a connection-scoped `_trailers` field that leaks between requests on keep-alive connections, but this version predates trailer support by 5 years. Trailer parsing was first added in Jetty 9.4.2 (January 2017); this version is from January 2012.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-10051" }, "impact_statement": "not_affected \u2014 Jetty 7.6.0.v20120127 does not implement HTTP trailer parsing. The CVE-2026-10051 vulnerability concerns a connection-scoped `_trailers` field that leaks between requests on keep-alive connections, but this version predates trailer support by 5 years. Trailer parsing was first added in Jetty 9.4.2 (January 2017); this version is from January 2012." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1605 does not affect version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server. Version 7.6.0.v20120127 is not vulnerable. Summary: Target repository (Jetty 7.6.0.v20120127) is not vulnerable to CVE-2026-1605. The vulnerability requires HTTP request decompression functionality that does not exist in Jetty 7.x. The affected code paths (GzipRequest, GzipDecoderSource, InflaterPool) are only present in Jetty 12.x architecture. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1605" }, "impact_statement": "Version 7.6.0.v20120127 is not vulnerable. Summary: Target repository (Jetty 7.6.0.v20120127) is not vulnerable to CVE-2026-1605. The vulnerability requires HTTP request decompression functionality that does not exist in Jetty 7.x. The affected code paths (GzipRequest, GzipDecoderSource, InflaterPool) are only present in Jetty 12.x architecture. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-server@7.6.0.v20120127-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6790 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server.", "vulnerability": { "name": "CVE-2026-6790" }, "action_statement": "Vulnerability CVE-2026-6790 affects version 7.6.0.v20120127-tuxcare.3 of org.eclipse.jetty:jetty-server." } ] }