{
  "@id": "urn:uuid:98a9dc6d-ea22-4047-9cbe-511b54ac3ad8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 31,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:15:11.464324+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T15:07:22.154174+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 9.4.60 is NOT affected by CVE-2006-6969 (predictable session identifiers). The target uses java.security.SecureRandom by default for session ID generation (DefaultSessionIdManager.java:374), not the vulnerable java.util.Random. This fix was present in the upstream release when TuxCare onboarded version 9.4.58.1. The vulnerable pattern (using Random by default) does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 Jetty 9.4.60 is NOT affected by CVE-2006-6969 (predictable session identifiers). The target uses java.security.SecureRandom by default for session ID generation (DefaultSessionIdManager.java:374), not the vulnerable java.util.Random. This fix was present in the upstream release when TuxCare onboarded version 9.4.58.1. The vulnerable pattern (using Random by default) does not exist in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 9.4.60 is not affected by CVE-2011-4461 (hash collision DoS via unlimited form parameters). The upstream fix commit 085c79d7d6cfbccc02821ffdb64968593df3e0bf, authored by Greg Wilkins (gregw@webtide.com) on 2011-12-30, was already present in the upstream release that TuxCare onboarded. The fix adds maxFormKeys defense (default 1000) enforced by UrlEncoded.checkMaxKeys() which th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 9.4.60 is not affected by CVE-2011-4461 (hash collision DoS via unlimited form parameters). The upstream fix commit 085c79d7d6cfbccc02821ffdb64968593df3e0bf, authored by Greg Wilkins (gregw@webtide.com) on 2011-12-30, was already present in the upstream release that TuxCare onboarded. The fix adds maxFormKeys defense (default 1000) enforced by UrlEncoded.checkMaxKeys() which th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-06T17:46:34.171368+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 9.4.60 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 9.4.60 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T15:26:39.614024+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 is NOT present in Eclipse Jetty 9.4.60.tuxcare0003. The vulnerability (path normalization allowing backslash-based bypasses on Windows) was fixed in upstream Jetty 9.3.9 (commit 97af3d663fd, May 2016) and carried forward to all 9.4.x releases. TuxCare onboarded Jetty 9.4.58.1 in March 2026, which already included this fix. The defense mechanism is present at PathResource.java:79 w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 is NOT present in Eclipse Jetty 9.4.60.tuxcare0003. The vulnerability (path normalization allowing backslash-based bypasses on Windows) was fixed in upstream Jetty 9.3.9 (commit 97af3d663fd, May 2016) and carried forward to all 9.4.x releases. TuxCare onboarded Jetty 9.4.58.1 in March 2026, which already included this fix. The defense mechanism is present at PathResource.java:79 w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2017-7656 (HTTP Request Smuggling via conflicting Content-Length/Transfer-Encoding headers) is not present in Jetty 9.4.60. The fix (commit a285deea42f) was authored by upstream developer Greg Wilkins and shipped in upstream Jetty 9.4.11 (June 2018), well before this version. The target includes the necessary defenses (_hasContentLength flag, duplicate Content-Length detection, mutual exclusivity checks for Content-Length and Transfer-Encoding) and defaults to RFC7230 compliance mode which enforces these protections. While the vulnerability can theoretically be exposed by explicitly configuring the deprecated RFC2616_LEGACY mode, the CVE description itself acknowledges this requires \"non-default configuration\", meaning the shipped default configuration is secure.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "CVE-2017-7656 (HTTP Request Smuggling via conflicting Content-Length/Transfer-Encoding headers) is not present in Jetty 9.4.60. The fix (commit a285deea42f) was authored by upstream developer Greg Wilkins and shipped in upstream Jetty 9.4.11 (June 2018), well before this version. The target includes the necessary defenses (_hasContentLength flag, duplicate Content-Length detection, mutual exclusivity checks for Content-Length and Transfer-Encoding) and defaults to RFC7230 compliance mode which enforces these protections. While the vulnerability can theoretically be exposed by explicitly configuring the deprecated RFC2616_LEGACY mode, the CVE description itself acknowledges this requires \"non-default configuration\", meaning the shipped default configuration is secure.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2017-7658 is not present in Jetty 9.4.60.tuxcare0003. The upstream fix by Greg Wilkins (commit a285deea42f) is already included in the base release. The target uses HttpCompliance.RFC7230 by default, which enforces protections against both multiple Content-Length headers and Content-Length + Transfer-Encoding combinations, preventing HTTP request smuggling attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "CVE-2017-7658 is not present in Jetty 9.4.60.tuxcare0003. The upstream fix by Greg Wilkins (commit a285deea42f) is already included in the base release. The target uses HttpCompliance.RFC7230 by default, which enforces protections against both multiple Content-Length headers and Content-Length + Transfer-Encoding combinations, preventing HTTP request smuggling attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2017-9735 timing attack vulnerability is NOT present in target Jetty 9.4.60. The constant-time comparison fix was already included in the upstream release that TuxCare onboarded. All password/credential comparison operations use stringEquals() and byteEquals() methods that prevent timing side-channel attacks through non-short-circuiting comparison logic. Fix authored by Simone Bordet (simone.bordet@gmail.com) in commits 042f325f through e727ad89, all predating the first TuxCare commit (0f6eea68338 \"setup 9.4.58.1\"). Verified across Password.java, Credential.java, DigestAuthenticator.java, and DigestAuthModule.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 timing attack vulnerability is NOT present in target Jetty 9.4.60. The constant-time comparison fix was already included in the upstream release that TuxCare onboarded. All password/credential comparison operations use stringEquals() and byteEquals() methods that prevent timing side-channel attacks through non-short-circuiting comparison logic. Fix authored by Simone Bordet (simone.bordet@gmail.com) in commits 042f325f through e727ad89, all predating the first TuxCare commit (0f6eea68338 \"setup 9.4.58.1\"). Verified across Password.java, Credential.java, DigestAuthenticator.java, and DigestAuthModule.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T18:03:53.463125+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 is NOT present in this target. The vulnerable code pattern (unhandled exceptions that leak full filesystem paths in error responses) was fixed by upstream commit ad4dceb1c08 \"Issue #2560 - Moving InvalidPath logic from ResourceContentFactory to ResourceContentFactory\", which was already in the upstream Jetty release when TuxCare onboarded version 9.4.58.1. The fix sanitizes Inval...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 is NOT present in this target. The vulnerable code pattern (unhandled exceptions that leak full filesystem paths in error responses) was fixed by upstream commit ad4dceb1c08 \"Issue #2560 - Moving InvalidPath logic from ResourceContentFactory to ResourceContentFactory\", which was already in the upstream Jetty release when TuxCare onboarded version 9.4.58.1. The fix sanitizes Inval..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2018-12545 is NOT present in Jetty 9.4.60. The vulnerability (DoS via excessive SETTINGS frames) was fixed by upstream Jetty developers in two stages: Issue #2722 (July 2018) added maxSettingsKeys limiting (default: 64 keys max per frame), and Issue #3978 (August 2019) added RateControl frame rate limiting (default: 128 frames per window). Both fixes were already included in the upstream Jetty 9.4.60 release that TuxCare onboarded (commit 5a62c8237e6). The target code contains both defenses active by default in SettingsBodyParser.java and AbstractHTTP2ServerConnectionFactory.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 is NOT present in Jetty 9.4.60. The vulnerability (DoS via excessive SETTINGS frames) was fixed by upstream Jetty developers in two stages: Issue #2722 (July 2018) added maxSettingsKeys limiting (default: 64 keys max per frame), and Issue #3978 (August 2019) added RateControl frame rate limiting (default: 128 frames per window). Both fixes were already included in the upstream Jetty 9.4.60 release that TuxCare onboarded (commit 5a62c8237e6). The target code contains both defenses active by default in SettingsBodyParser.java and AbstractHTTP2ServerConnectionFactory.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T16:05:14.368413+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 affects Eclipse Jetty versions 9.4.15 and older with an XSS vulnerability in directory listings. The target version 9.4.60 is not affected because the upstream vendor (Eclipse Jetty project) already fixed this vulnerability in commits ca77bd384a2 (Issue #3319) and 7b774d82e82 (Issue #3549), both authored by joakim.erdfelt@gmail.com. These fixes were already present in the upstrea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 affects Eclipse Jetty versions 9.4.15 and older with an XSS vulnerability in directory listings. The target version 9.4.60 is not affected because the upstream vendor (Eclipse Jetty project) already fixed this vulnerability in commits ca77bd384a2 (Issue #3319) and 7b774d82e82 (Issue #3549), both authored by joakim.erdfelt@gmail.com. These fixes were already present in the upstrea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 is not present in the target. The vulnerability allowed Windows directory listings to expose full filesystem paths due to naive forward-slash parsing that failed on Windows backslash separators. The fix (using File.getName() for file resources and proper URL segment extraction) was implemented in upstream commit 7b774d82e82 by Joakim Erdfelt and shipped in Jetty 9.4.20 (April 201...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 is not present in the target. The vulnerability allowed Windows directory listings to expose full filesystem paths due to naive forward-slash parsing that failed on Windows backslash separators. The fix (using File.getName() for file resources and proper URL segment extraction) was implemented in upstream commit 7b774d82e82 by Joakim Erdfelt and shipped in Jetty 9.4.20 (April 201..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T16:29:00.107208+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 affects Jetty 9.4.16 and older. The target version 9.4.60 is not affected because the vulnerability fix (removal of base resource path disclosure in DefaultHandler's 404 error pages) was already present in the upstream release. The fix was authored by upstream Jetty developer Joakim Erdfelt in April 2019 (commits 04c994712c0 and 9f506e4123b - Issue #3555), which predates TuxCare'...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 affects Jetty 9.4.16 and older. The target version 9.4.60 is not affected because the vulnerability fix (removal of base resource path disclosure in DefaultHandler's 404 error pages) was already present in the upstream release. The fix was authored by upstream Jetty developer Joakim Erdfelt in April 2019 (commits 04c994712c0 and 9f506e4123b - Issue #3555), which predates TuxCare'..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T19:15:00.519823+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target version 9.4.60 is not affected by CVE-2019-17632. The vulnerability (unescaped exception messages in error pages leading to XSS) was fixed in upstream Jetty 9.4.24.v20191120 (November 2019) by commits cf0df6e3ffd and 9e40fc9a6fb. The TuxCare branch started from version 9.4.58.1 which already contained the upstream fix. All exception messages and stack traces are properly sanitized us...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 The target version 9.4.60 is not affected by CVE-2019-17632. The vulnerability (unescaped exception messages in error pages leading to XSS) was fixed in upstream Jetty 9.4.24.v20191120 (November 2019) by commits cf0df6e3ffd and 9e40fc9a6fb. The TuxCare branch started from version 9.4.58.1 which already contained the upstream fix. All exception messages and stack traces are properly sanitized us..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. Target version 9.4.60.tuxcare0003 is NOT AFFECTED by CVE-2019-17638. The vulnerability (double-release of ByteBuffer causing cross-client data leakage) was fixed by upstream commit ff8ae56fa93 (authored by gregw@webtide.com) which shipped in the upstream release before TuxCare onboarding. The fix is present at lines 770-777 of HttpConnection.java: the HEADER_OVERFLOW case checks buffer capacity BEFORE releasing it back to the pool, preventing the double-release that would allow two threads to acquire the same buffer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "Target version 9.4.60.tuxcare0003 is NOT AFFECTED by CVE-2019-17638. The vulnerability (double-release of ByteBuffer causing cross-client data leakage) was fixed by upstream commit ff8ae56fa93 (authored by gregw@webtide.com) which shipped in the upstream release before TuxCare onboarding. The fix is present at lines 770-777 of HttpConnection.java: the HEADER_OVERFLOW case checks buffer capacity BEFORE releasing it back to the pool, preventing the double-release that would allow two threads to acquire the same buffer.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T19:34:19.897070+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target repository Jetty 9.4.60 is not affected by CVE-2020-27218. The vulnerability (unconsumed GZIP request body bleeding into subsequent requests on persistent connections) was fixed by upstream commit 14f94f738df authored by Greg Wilkins (gregw@webtide.com) in November 2020. This fix was already present in the upstream release before TuxCare onboarded version 9.4.58.1 (first TuxCare commit 0...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 Target repository Jetty 9.4.60 is not affected by CVE-2020-27218. The vulnerability (unconsumed GZIP request body bleeding into subsequent requests on persistent connections) was fixed by upstream commit 14f94f738df authored by Greg Wilkins (gregw@webtide.com) in November 2020. This fix was already present in the upstream release before TuxCare onboarded version 9.4.58.1 (first TuxCare commit 0..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T19:27:33.940034+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223 affects Jetty's QuotedQualityCSV class which used an inefficient O(n\u00b2) bubble-sort-like algorithm to sort HTTP header quality parameters, causing CPU exhaustion DoS with many quality values. The target repository (Jetty 9.4.60.tuxcare0003 at SHA f2302263acb65f8ac318bbe9045f18c261feccf2) contains the upstream fix committed in 10e531756b972162eed402c44d0244f7f6b85131 by Joakim Erdf...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27223 affects Jetty's QuotedQualityCSV class which used an inefficient O(n\u00b2) bubble-sort-like algorithm to sort HTTP header quality parameters, causing CPU exhaustion DoS with many quality values. The target repository (Jetty 9.4.60.tuxcare0003 at SHA f2302263acb65f8ac318bbe9045f18c261feccf2) contains the upstream fix committed in 10e531756b972162eed402c44d0244f7f6b85131 by Joakim Erdf..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2021-28165 fix was already present in upstream Jetty 9.4.39 (released 2021-03-25), which predates the TuxCare onboarding of version 9.4.58.1. The vulnerable code pattern never existed in the TuxCare 9.4.60 branch. The current code at SslConnection.java:753-757 contains the defense that checks for buffer overflow (BufferUtil.space == 0) and throws SSLHandshakeException, preventing the infinite loop that causes CPU exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "CVE-2021-28165 fix was already present in upstream Jetty 9.4.39 (released 2021-03-25), which predates the TuxCare onboarding of version 9.4.58.1. The vulnerable code pattern never existed in the TuxCare 9.4.60 branch. The current code at SslConnection.java:753-757 contains the defense that checks for buffer overflow (BufferUtil.space == 0) and throws SSLHandshakeException, preventing the infinite loop that causes CPU exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "Version 9.4.60 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-10T04:15:11.464324+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Jetty 9.4.60 is not affected because its default buffer pool does not retain unreleased buffers, allowing them to be garbage-collected after connection disposal. In jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:181 and :208, buffers are removed from the pool on acquisition and returned only on release. Unreturned buffers remain eligible for garbage collection under the contract documented at jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:33.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Jetty 9.4.60 is not affected because its default buffer pool does not retain unreleased buffers, allowing them to be garbage-collected after connection disposal. In jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:181 and :208, buffers are removed from the pool on acquisition and returned only on release. Unreturned buffers remain eligible for garbage collection under the contract documented at jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:33."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T15:27:30.496893+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 9.4.60 is not affected. The upstream fix for CVE-2023-26048 (commit 1042cdb8a54) was released in Jetty 9.4.51.v20230217 and is already present in the 9.4.58.1 release that TuxCare onboarded. The fix adds two defenses: (1) maximum part count limit (1000 by default) throwing IllegalStateException when exceeded, and (2) cumulative size limit for form fields (parts without filenames)...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 Target version 9.4.60 is not affected. The upstream fix for CVE-2023-26048 (commit 1042cdb8a54) was released in Jetty 9.4.51.v20230217 and is already present in the 9.4.58.1 release that TuxCare onboarded. The fix adds two defenses: (1) maximum part count limit (1000 by default) throwing IllegalStateException when exceeded, and (2) cumulative size limit for form fields (parts without filenames)..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T14:57:00.087102+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 9.4.60) is NOT AFFECTED by CVE-2023-26049. The vulnerability (cookie smuggling via semicolons in quoted cookie values) was fixed by upstream commit 1be1401bafb authored by Greg Wilkins on Feb 16, 2023. This fix was already present in the upstream Jetty 9.4.51+ releases and was included when TuxCare onboarded version 9.4.58.1. The defense code at CookieCutter.java:20...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 9.4.60) is NOT AFFECTED by CVE-2023-26049. The vulnerability (cookie smuggling via semicolons in quoted cookie values) was fixed by upstream commit 1be1401bafb authored by Greg Wilkins on Feb 16, 2023. This fix was already present in the upstream Jetty 9.4.51+ releases and was included when TuxCare onboarded version 9.4.58.1. The defense code at CookieCutter.java:20..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. Target repository at version 9.4.60 is NOT AFFECTED by CVE-2024-13009. The vulnerability affects Jetty versions 9.4.0 to 9.4.56. The upstream fix (commit e3fa9466633) was backported to Jetty 9.4.57 on 19 December 2024, and version 9.4.60 (released 6 March 2026) includes this fix. All four key protective changes from the patch are present in the target code: (1) _content nullification in fail() at lines 187-188, (2) !isError() check in nextContent() at line 382, (3) direct interceptor invocation without wrapper at line 466, and (4) _content nullification in addContent() at lines 597-598. The fix was authored by upstream Jetty developer gregw@webtide.com and shipped in the upstream 9.4.60 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "Target repository at version 9.4.60 is NOT AFFECTED by CVE-2024-13009. The vulnerability affects Jetty versions 9.4.0 to 9.4.56. The upstream fix (commit e3fa9466633) was backported to Jetty 9.4.57 on 19 December 2024, and version 9.4.60 (released 6 March 2026) includes this fix. All four key protective changes from the patch are present in the target code: (1) _content nullification in fail() at lines 187-188, (2) !isError() check in nextContent() at line 382, (3) direct interceptor invocation without wrapper at line 466, and (4) _content nullification in addContent() at lines 597-598. The fix was authored by upstream Jetty developer gregw@webtide.com and shipped in the upstream 9.4.60 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-10T04:15:11.464324+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because existing cleanup returns empty request buffers to the pool after zero-byte body reads. Both fill callers invoke parsing before checking the read result (jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:260, :327), and parsing releases empty buffers when no content references remain (jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:387, :224).",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because existing cleanup returns empty request buffers to the pool after zero-byte body reads. Both fill callers invoke parsing before checking the read result (jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:260, :327), and parsing releases empty buffers when no content references remain (jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:387, :224)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 affects version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "action_statement": "Vulnerability CVE-2026-10051 affects version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.60.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 affects version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server, and is fixed in 9.4.60.tuxcare0003.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "action_statement": "Vulnerability CVE-2026-6790 affects version 9.4.60.tuxcare0002 of org.eclipse.jetty:jetty-server, and is fixed in 9.4.60.tuxcare0003."
    }
  ]
}