{
  "@id": "urn:uuid:5c2fe262-e7f5-45fd-892f-3086481b807c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:16:00.061099+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T15:07:22.154174+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 concerns predictable session identifiers generated using java.util.Random in Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3. The target (Jetty 9.4.61.tuxcare0003) is not affected because the vulnerable code pattern is not present. The code uses SecureRandom by default for session ID generation (DefaultSessionIdManager.java:374), with java.util.Random only as an excepti...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 concerns predictable session identifiers generated using java.util.Random in Jetty versions before 4.2.27, 5.1.12, 6.0.2, and 6.1.0pre3. The target (Jetty 9.4.61.tuxcare0003) is not affected because the vulnerable code pattern is not present. The code uses SecureRandom by default for session ID generation (DefaultSessionIdManager.java:374), with java.util.Random only as an excepti..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 9.4.61.tuxcare0003 is NOT AFFECTED. The vulnerability (CVE-2011-4461) allowed hash collision DoS via unlimited form parameters. The upstream fix (commit 085c79d7d6c by Greg Wilkins) was already present in the release before TuxCare onboarding. The defense limits form parameters to 1000 keys by default via ContextHandler.DEFAULT_MAX_FORM_KEYS and enforces it through UrlEncoded.che...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 Target version 9.4.61.tuxcare0003 is NOT AFFECTED. The vulnerability (CVE-2011-4461) allowed hash collision DoS via unlimited form parameters. The upstream fix (commit 085c79d7d6c by Greg Wilkins) was already present in the release before TuxCare onboarding. The defense limits form parameters to 1000 keys by default via ContextHandler.DEFAULT_MAX_FORM_KEYS and enforces it through UrlEncoded.che..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-06T17:46:52.268713+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 9.4.61 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 9.4.61 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T15:30:13.587550+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Jetty 9.3.x before 9.3.9 and concerns Windows-specific path normalization vulnerabilities where URLs with escaped backslashes (%5C) could bypass protected resource restrictions. The target is Jetty 9.4.61.tuxcare0003, which includes the upstream fix (commit 97af3d663fd) applied by Joakim Erdfelt on 2016-05-13. The fix introduced backslash encoding in URIUtil.encodePath() a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Jetty 9.3.x before 9.3.9 and concerns Windows-specific path normalization vulnerabilities where URLs with escaped backslashes (%5C) could bypass protected resource restrictions. The target is Jetty 9.4.61.tuxcare0003, which includes the upstream fix (commit 97af3d663fd) applied by Joakim Erdfelt on 2016-05-13. The fix introduced backslash encoding in URIUtil.encodePath() a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. Target Jetty 9.4.61 is NOT affected by CVE-2017-7656 in its default configuration. The upstream fix commit a285deea42f (May 2018, \"RFC2616 vs RFC7230 cleanup\") removed the vulnerable pattern by introducing RFC7230 compliance mode as default, which rejects HTTP requests containing both Content-Length and Transfer-Encoding headers, and rejects duplicate Content-Length headers. This fix was already present in the upstream release that TuxCare onboarded. The CVE explicitly states it affects \"9.4.x (non-default configuration with RFC2616 compliance enabled)\" - the vulnerability only manifests when users explicitly configure the non-default RFC2616_LEGACY mode, which is documented to allow these RFC7230 violations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "Target Jetty 9.4.61 is NOT affected by CVE-2017-7656 in its default configuration. The upstream fix commit a285deea42f (May 2018, \"RFC2616 vs RFC7230 cleanup\") removed the vulnerable pattern by introducing RFC7230 compliance mode as default, which rejects HTTP requests containing both Content-Length and Transfer-Encoding headers, and rejects duplicate Content-Length headers. This fix was already present in the upstream release that TuxCare onboarded. The CVE explicitly states it affects \"9.4.x (non-default configuration with RFC2616 compliance enabled)\" - the vulnerability only manifests when users explicitly configure the non-default RFC2616_LEGACY mode, which is documented to allow these RFC7230 violations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2017-7658 (HTTP Request Smuggling via ambiguous Content-Length headers) is NOT present in Jetty 9.4.61. The vulnerability fix (commit a285deea42f by Greg Wilkins, May 2018) was already included in the upstream release that TuxCare onboarded. The defense code exists in HttpParser.java and is active by default via RFC7230 compliance mode, which enforces MULTIPLE_CONTENT_LENGTHS and TRANSFER_ENCODING_WITH_CONTENT_LENGTH checks. The vulnerable pattern (accepting multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "CVE-2017-7658 (HTTP Request Smuggling via ambiguous Content-Length headers) is NOT present in Jetty 9.4.61. The vulnerability fix (commit a285deea42f by Greg Wilkins, May 2018) was already included in the upstream release that TuxCare onboarded. The defense code exists in HttpParser.java and is active by default via RFC7230 compliance mode, which enforces MULTIPLE_CONTENT_LENGTHS and TRANSFER_ENCODING_WITH_CONTENT_LENGTH checks. The vulnerable pattern (accepting multiple Content-Length headers or Content-Length + Transfer-Encoding: chunked) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. Target version 9.4.61.tuxcare0003 is NOT vulnerable to CVE-2017-9735 timing channel attack. The vulnerable code pattern (variable-time password comparison using standard String.equals/Arrays.equals) is not present in HEAD. The fix was introduced by upstream commit 042f325f1cd (author: Simone Bordet) and was already included in upstream release 9.4.58.1, which TuxCare onboarded as the base for this branch. All password comparison paths in the current code use the constant-time stringEquals() method that employs bitwise AND accumulation without early exit, preventing timing attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "Target version 9.4.61.tuxcare0003 is NOT vulnerable to CVE-2017-9735 timing channel attack. The vulnerable code pattern (variable-time password comparison using standard String.equals/Arrays.equals) is not present in HEAD. The fix was introduced by upstream commit 042f325f1cd (author: Simone Bordet) and was already included in upstream release 9.4.58.1, which TuxCare onboarded as the base for this branch. All password comparison paths in the current code use the constant-time stringEquals() method that employs bitwise AND accumulation without early exit, preventing timing attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T18:07:00.156180+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 is NOT present in Jetty 9.4.61. The upstream fix (commit ad4dceb1c08) was shipped in the upstream release before TuxCare onboarding. ResourceContentFactory.getContent() wraps all exceptions in a sanitized InvalidPathException containing only the user-provided path context, preventing full filesystem path disclosure in error responses. The vulnerable pattern (unfiltered exception ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 is NOT present in Jetty 9.4.61. The upstream fix (commit ad4dceb1c08) was shipped in the upstream release before TuxCare onboarding. ResourceContentFactory.getContent() wraps all exceptions in a sanitized InvalidPathException containing only the user-provided path context, preventing full filesystem path disclosure in error responses. The vulnerable pattern (unfiltered exception ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. Eclipse Jetty 9.4.61 is NOT AFFECTED by CVE-2018-12545. The vulnerability, which allowed DoS via large SETTINGS frames or many small SETTINGS frames, was fixed by upstream in commit 9eca404da296 (July 2018) and released in version 9.4.12 (August 2018). The target version 9.4.61 includes both defense mechanisms: (1) maxSettingsKeys limit defaulting to 64 keys per frame, and (2) WindowRateControl limiting frame rate to 128 events/second. Both defenses are active by default and properly prevent the vulnerability described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "Eclipse Jetty 9.4.61 is NOT AFFECTED by CVE-2018-12545. The vulnerability, which allowed DoS via large SETTINGS frames or many small SETTINGS frames, was fixed by upstream in commit 9eca404da296 (July 2018) and released in version 9.4.12 (August 2018). The target version 9.4.61 includes both defense mechanisms: (1) maxSettingsKeys limit defaulting to 64 keys per frame, and (2) WindowRateControl limiting frame rate to 128 events/second. Both defenses are active by default and properly prevent the vulnerability described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T16:07:16.183547+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 9.4.61 is NOT affected by CVE-2019-10241. The upstream vendor fix (commit ca77bd384a2970cabbbdab25cf6251c6fb76cd21 by Joakim Erdfelt, dated April 3, 2019) was already present in the upstream 9.4.61 release when TuxCare onboarded it. The fix implements proper query parameter validation in directory listings, preventing XSS attacks by parsing and whitelisting only safe parameter va...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 Target version 9.4.61 is NOT affected by CVE-2019-10241. The upstream vendor fix (commit ca77bd384a2970cabbbdab25cf6251c6fb76cd21 by Joakim Erdfelt, dated April 3, 2019) was already present in the upstream 9.4.61 release when TuxCare onboarded it. The fix implements proper query parameter validation in directory listings, preventing XSS attacks by parsing and whitelisting only safe parameter va..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 is NOT present in target version 9.4.61. The vulnerability (exposure of fully qualified filesystem paths in directory listings on Windows) was fixed by upstream commit 7b774d82e82 authored by joakim.erdfelt@gmail.com, which shipped in the upstream release before TuxCare's onboarding commit. The target uses the secure getFileName() method that extracts only the filename component,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 is NOT present in target version 9.4.61. The vulnerability (exposure of fully qualified filesystem paths in directory listings on Windows) was fixed by upstream commit 7b774d82e82 authored by joakim.erdfelt@gmail.com, which shipped in the upstream release before TuxCare's onboarding commit. The target uses the secure getFileName() method that extracts only the filename component,..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T16:31:00.169715+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 9.4.61 is not affected by CVE-2019-10247. The vulnerability involved the DefaultHandler revealing the fully qualified directory base resource location in 404 error responses through a context.toString() call. This was fixed in upstream commits 6d847d4a73b and d983890d176 (Issue #3555) by Joakim Erdfelt, which shipped in the upstream release that TuxCare onboarded (version 9.4.5...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 9.4.61 is not affected by CVE-2019-10247. The vulnerability involved the DefaultHandler revealing the fully qualified directory base resource location in 404 error responses through a context.toString() call. This was fixed in upstream commits 6d847d4a73b and d983890d176 (Issue #3555) by Joakim Erdfelt, which shipped in the upstream release that TuxCare onboarded (version 9.4.5..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T19:15:55.561862+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 affects Jetty 9.4.21-9.4.23 where exception messages and stack traces in error responses were not escaped, enabling XSS attacks. The target (Jetty 9.4.61) contains upstream fixes from commits cf0df6e3ffd and 9e40fc9a6fb (Issue #4334) that sanitize all exception content via StringUtil.sanitizeXmlString() before rendering in HTML/JSON error pages. These fixes were authored by Joaki...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 affects Jetty 9.4.21-9.4.23 where exception messages and stack traces in error responses were not escaped, enabling XSS attacks. The target (Jetty 9.4.61) contains upstream fixes from commits cf0df6e3ffd and 9e40fc9a6fb (Issue #4334) that sanitize all exception content via StringUtil.sanitizeXmlString() before rendering in HTML/JSON error pages. These fixes were authored by Joaki..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. The target is not affected by CVE-2019-17638. The upstream fix (commit ff8ae56fa93) that prevents double-release of ByteBuffers was already present in the Jetty 9.4.61 release that TuxCare onboarded. The vulnerable pattern\u2014where response header overflow caused a ByteBuffer to be released twice, enabling cross-client data leakage\u2014has been eliminated through proper buffer lifecycle management.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "The target is not affected by CVE-2019-17638. The upstream fix (commit ff8ae56fa93) that prevents double-release of ByteBuffers was already present in the Jetty 9.4.61 release that TuxCare onboarded. The vulnerable pattern\u2014where response header overflow caused a ByteBuffer to be released twice, enabling cross-client data leakage\u2014has been eliminated through proper buffer lifecycle management.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T19:33:31.796686+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 is not present in Jetty 9.4.61.tuxcare0003. The vulnerability (unconsumed GZIP request body data prepended to subsequent requests on persistent connections) was fixed by upstream commit 14f94f738df authored by Greg Wilkins (gregw@webtide.com). This fix was already included in the upstream Jetty 9.4.61 release before TuxCare onboarded it. All defense mechanisms are present: HttpIn...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 is not present in Jetty 9.4.61.tuxcare0003. The vulnerability (unconsumed GZIP request body data prepended to subsequent requests on persistent connections) was fixed by upstream commit 14f94f738df authored by Greg Wilkins (gregw@webtide.com). This fix was already included in the upstream Jetty 9.4.61 release before TuxCare onboarded it. All defense mechanisms are present: HttpIn..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T19:27:33.940034+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target repository version 9.4.61 is not affected by CVE-2020-27223. The vulnerability (inefficient O(n\u00b2) bubble-sort in QuotedQualityCSV causing DoS) was fixed in upstream Jetty 9.4.37+ via commit 10e531756b9 (Feb 2021). The fix replaced the vulnerable bubble-sort algorithm with an efficient O(n log n) stream-based sort using Java's TimSort. This upstream fix was already present in the release ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 Target repository version 9.4.61 is not affected by CVE-2020-27223. The vulnerability (inefficient O(n\u00b2) bubble-sort in QuotedQualityCSV causing DoS) was fixed in upstream Jetty 9.4.37+ via commit 10e531756b9 (Feb 2021). The fix replaced the vulnerable bubble-sort algorithm with an efficient O(n log n) stream-based sort using Java's TimSort. This upstream fix was already present in the release ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. CVE-2021-28165 is not present in Jetty 9.4.61. The vulnerability was fixed in upstream commit 294b2ba02b6 (March 22, 2021) by Simone Bordet, which shipped in Jetty 9.4.39 and all subsequent releases. The fix checks if the encrypted input buffer is full (BufferUtil.space(_encryptedInput) == 0) and throws an SSLHandshakeException to prevent the infinite CPU loop. This fix was already present in the upstream release when TuxCare onboarded version 9.4.58.1 in December 2025.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "CVE-2021-28165 is not present in Jetty 9.4.61. The vulnerability was fixed in upstream commit 294b2ba02b6 (March 22, 2021) by Simone Bordet, which shipped in Jetty 9.4.39 and all subsequent releases. The fix checks if the encrypted input buffer is full (BufferUtil.space(_encryptedInput) == 0) and throws an SSLHandshakeException to prevent the infinite CPU loop. This fix was already present in the upstream release when TuxCare onboarded version 9.4.58.1 in December 2025.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. Version 9.4.61 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "Version 9.4.61 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-10T04:16:00.061099+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its buffer pool does not retain checked-out buffers, so skipped releases do not cause persistent pool retention. Bucket acquisition removes buffers with poll() in jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:183, and release reinserts them at jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:214. Unreleased buffers can be garbage-collected, as documented in jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:35.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its buffer pool does not retain checked-out buffers, so skipped releases do not cause persistent pool retention. Bucket acquisition removes buffers with poll() in jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:183, and release reinserts them at jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:214. Unreleased buffers can be garbage-collected, as documented in jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:35."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T15:29:00.073012+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 9.4.61) is not affected by CVE-2023-26048. The vulnerability was fixed in upstream Jetty 9.4.51.v20230217 by commit 1042cdb8a54e (authored by lachlan@webtide.com on 2023-02-13), which added two defenses: (1) a limit on the number of multipart parts (_numParts check with DEFAULT_MAX_FORM_KEYS=1000), and (2) a limit on cumulative in-memory content size for parts witho...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 9.4.61) is not affected by CVE-2023-26048. The vulnerability was fixed in upstream Jetty 9.4.51.v20230217 by commit 1042cdb8a54e (authored by lachlan@webtide.com on 2023-02-13), which added two defenses: (1) a limit on the number of multipart parts (_numParts check with DEFAULT_MAX_FORM_KEYS=1000), and (2) a limit on cumulative in-memory content size for parts witho..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-31T14:57:00.087102+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values with semicolons) is NOT present in Jetty 9.4.61. The vulnerability was fixed in upstream Jetty 9.4.51.v20230217 by commit 1be1401bafb (authored by Greg Wilkins). The TuxCare branch is based on 9.4.58.1/9.4.61, which already includes this upstream fix. The vulnerable pattern (continuing to parse past semicolons inside quoted cookie values) does ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values with semicolons) is NOT present in Jetty 9.4.61. The vulnerability was fixed in upstream Jetty 9.4.51.v20230217 by commit 1be1401bafb (authored by Greg Wilkins). The TuxCare branch is based on 9.4.58.1/9.4.61, which already includes this upstream fix. The vulnerable pattern (continuing to parse past semicolons inside quoted cookie values) does ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. Target repository (Jetty 9.4.61.tuxcare0003) is NOT AFFECTED by CVE-2024-13009. The upstream fix (commit e3fa9466633db6bf36e0eb0d17e3de166c788ede by gregw@webtide.com, Dec 19, 2024) was already present in the upstream 9.4.61 release before TuxCare onboarded the project (first TuxCare commit Dec 12, 2025). The CVE describes a buffer incorrectly released on gzip decompression errors, allowing data sharing between requests. All five components of the fix are present and active in the target: (1) _content nulled in fail() method line 188, (2) _content nulled in addContent() method line 598, (3) error-state check at line 382, (4) direct interceptor call at line 466, (5) intercept() wrapper removed. No alternative gzip decompression paths exist; all HTTP request gzip handling goes through the fixed HttpInput interceptor mechanism. Verdict Validation Protocol completed: checked for reverts (none), alternative paths (none), missed error locations (none). The vulnerable pattern (buffer not nulled after decompression failure) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "Target repository (Jetty 9.4.61.tuxcare0003) is NOT AFFECTED by CVE-2024-13009. The upstream fix (commit e3fa9466633db6bf36e0eb0d17e3de166c788ede by gregw@webtide.com, Dec 19, 2024) was already present in the upstream 9.4.61 release before TuxCare onboarded the project (first TuxCare commit Dec 12, 2025). The CVE describes a buffer incorrectly released on gzip decompression errors, allowing data sharing between requests. All five components of the fix are present and active in the target: (1) _content nulled in fail() method line 188, (2) _content nulled in addContent() method line 598, (3) error-state check at line 382, (4) direct interceptor call at line 466, (5) intercept() wrapper removed. No alternative gzip decompression paths exist; all HTTP request gzip handling goes through the fixed HttpInput interceptor mechanism. Verdict Validation Protocol completed: checked for reverts (none), alternative paths (none), missed error locations (none). The vulnerable pattern (buffer not nulled after decompression failure) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-09T20:55:00.104909+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Request-body reads reach the connection through HttpInputOverHTTP.java:33. Both fill callers subsequently parse before acting on a zero-byte result (HttpConnection.java:260, HttpConnection.java:327). Filling rejects outstanding content references, while empty input cannot enter the parser\u2019s content-emission loop (HttpConnection.java:337; HttpParser.java:1697). Parsing releases the buffer when the reference count is zero; release clears the connection\u2019s field and returns the empty buffer to its pool (HttpConnection.java:387, HttpConnection.java:224). Actual content references also release on completion or failure (HttpConnection.java:640). Consequently, the described zero-byte body read has existing cleanup despite lacking the upstream inline release addition.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Request-body reads reach the connection through HttpInputOverHTTP.java:33. Both fill callers subsequently parse before acting on a zero-byte result (HttpConnection.java:260, HttpConnection.java:327). Filling rejects outstanding content references, while empty input cannot enter the parser\u2019s content-emission loop (HttpConnection.java:337; HttpParser.java:1697). Parsing releases the buffer when the reference count is zero; release clears the connection\u2019s field and returns the empty buffer to its pool (HttpConnection.java:387, HttpConnection.java:224). Actual content references also release on completion or failure (HttpConnection.java:640). Consequently, the described zero-byte body read has existing cleanup despite lacking the upstream inline release addition."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 affects version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "action_statement": "Vulnerability CVE-2026-10051 affects version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.61.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 affects version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server, and is fixed in 9.4.61.tuxcare0003.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "action_statement": "Vulnerability CVE-2026-6790 affects version 9.4.61.tuxcare0002 of org.eclipse.jetty:jetty-server, and is fixed in 9.4.61.tuxcare0003."
    }
  ]
}