{
  "@id": "urn:uuid:8c69c6a3-71e4-4d5e-ba0b-ae7ddc229d45",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:15:11.464324+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-09T10:28:45.646681+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. Checked by hand: jetty.project has no upstream fix for this CVE (the fix is in the Jetty 6 code base, 2006); this version's session-ID generator DefaultSessionIdManager uses SecureRandom, and the tree has no Jetty 6 (org.mortbay) code. Advisories: GitHub says fixed in 6.1.0pre3 (Jetty 4 to 6), and this version is on a newer line; NVD lists only releases 4.2.9 to 6.1.0_pre2. Confirmed not affected by the Java ELS team review on 2026-11-06.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "Checked by hand: jetty.project has no upstream fix for this CVE (the fix is in the Jetty 6 code base, 2006); this version's session-ID generator DefaultSessionIdManager uses SecureRandom, and the tree has no Jetty 6 (org.mortbay) code. Advisories: GitHub says fixed in 6.1.0pre3 (Jetty 4 to 6), and this version is on a newer line; NVD lists only releases 4.2.9 to 6.1.0_pre2. Confirmed not affected by the Java ELS team review on 2026-11-06."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 describes a hash collision DoS vulnerability in Jetty 8.1.0.RC2 and earlier, where unlimited form parameters can cause CPU exhaustion. The target (Jetty 9.4.63.tuxcare0001) is not affected because the upstream fix (commit 085c79d7d6c by Greg Wilkins, Dec 2011) was already present in the Jetty 9.4.58.1+ release that TuxCare onboarded. The fix implements a maxFormKeys limit (default...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-4461 describes a hash collision DoS vulnerability in Jetty 8.1.0.RC2 and earlier, where unlimited form parameters can cause CPU exhaustion. The target (Jetty 9.4.63.tuxcare0001) is not affected because the upstream fix (commit 085c79d7d6c by Greg Wilkins, Dec 2011) was already present in the Jetty 9.4.58.1+ release that TuxCare onboarded. The fix implements a maxFormKeys limit (default..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T17:47:10.017438+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 9.4.63 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 9.4.63 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:30:13.587550+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9. The target version is 9.4.63.tuxcare0001, which already contains the upstream fix that was applied in version 9.3.9 (May 2016). The vulnerability involved Windows path normalization bypass using escaped backslashes in URLs. The fix (commit 97af3d663fd) added URI comparison checks in PathResource.checkAliasPath() to detect when Java's Path ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9. The target version is 9.4.63.tuxcare0001, which already contains the upstream fix that was applied in version 9.3.9 (May 2016). The vulnerability involved Windows path normalization bypass using escaped backslashes in URLs. The fix (commit 97af3d663fd) added URI comparison checks in PathResource.checkAliasPath() to detect when Java's Path ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7656 (HTTP Request Smuggling) is NOT present in target jetty-project 9.4.63.tuxcare0001. The upstream fix (commit a285deea42f by Greg Wilkins) shipped with the upstream Jetty release before TuxCare onboarding. All three defensive behaviors are present: (1) multiple Content-Length header detection, (2) Content-Length + Transfer-Encoding mutual exclusion validation, and (3) chunk size overflow protection. The vulnerable pattern (accepting ambiguous Content-Length/Transfer-Encoding combinations that enable request smuggling) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "CVE-2017-7656 (HTTP Request Smuggling) is NOT present in target jetty-project 9.4.63.tuxcare0001. The upstream fix (commit a285deea42f by Greg Wilkins) shipped with the upstream Jetty release before TuxCare onboarding. All three defensive behaviors are present: (1) multiple Content-Length header detection, (2) Content-Length + Transfer-Encoding mutual exclusion validation, and (3) chunk size overflow protection. The vulnerable pattern (accepting ambiguous Content-Length/Transfer-Encoding combinations that enable request smuggling) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-09T10:28:12.128172+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: the upstream fix is already in this version's git history (commits 1a4d304a, 715a637c, a285deea, d35a332b, e05c11ae). Advisories: GitHub says fixed in 9.2.25 and 9.3.24 and NVD in 9.4.11, and this version is later on the same line; the cve.org record reads as affected only because it writes each range as two half-entries. Confirmed not affected by the Java ELS team review on 2026-11-06.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "impact_statement": "Prechecker: the upstream fix is already in this version's git history (commits 1a4d304a, 715a637c, a285deea, d35a332b, e05c11ae). Advisories: GitHub says fixed in 9.2.25 and 9.3.24 and NVD in 9.4.11, and this version is later on the same line; the cve.org record reads as affected only because it writes each range as two half-entries. Confirmed not affected by the Java ELS team review on 2026-11-06."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7658 is not present in Jetty 9.4.63. The vulnerability was fixed in upstream commit a285deea42f by Greg Wilkins in May 2018 (Jetty 9.2.26), which predates version 9.4.63. The fix adds protections against HTTP Request Smuggling by rejecting requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding: chunked headers. The target version includes these protections with RFC7230 compliance mode (default), which enforces MULTIPLE_CONTENT_LENGTHS and TRANSFER_ENCODING_WITH_CONTENT_LENGTH checks. Since this fix was in the upstream release before TuxCare maintenance began (first TuxCare commit: 9bc35a9fd4e), this is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "CVE-2017-7658 is not present in Jetty 9.4.63. The vulnerability was fixed in upstream commit a285deea42f by Greg Wilkins in May 2018 (Jetty 9.2.26), which predates version 9.4.63. The fix adds protections against HTTP Request Smuggling by rejecting requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding: chunked headers. The target version includes these protections with RFC7230 compliance mode (default), which enforces MULTIPLE_CONTENT_LENGTHS and TRANSFER_ENCODING_WITH_CONTENT_LENGTH checks. Since this fix was in the upstream release before TuxCare maintenance began (first TuxCare commit: 9bc35a9fd4e), this is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-9735 describes a timing channel attack in Jetty's password comparison code that allows attackers to infer password characters and length by measuring elapsed times. The target (Jetty 9.4.63) is NOT AFFECTED because the upstream fix was already present in the release that TuxCare onboarded. All three fix commits (042f325f1cd, f3751d70787, 2baa1abe4b1) authored by Simone Bordet were included in upstream Jetty 9.4.58.1, which predates the first TuxCare commit (9bc35a9fd4e \"setup 9.4.58.1\"). The vulnerable pattern (non-constant-time string/byte comparison) has been replaced with constant-time comparison methods throughout the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 describes a timing channel attack in Jetty's password comparison code that allows attackers to infer password characters and length by measuring elapsed times. The target (Jetty 9.4.63) is NOT AFFECTED because the upstream fix was already present in the release that TuxCare onboarded. All three fix commits (042f325f1cd, f3751d70787, 2baa1abe4b1) authored by Simone Bordet were included in upstream Jetty 9.4.58.1, which predates the first TuxCare commit (9bc35a9fd4e \"setup 9.4.58.1\"). The vulnerable pattern (non-constant-time string/byte comparison) has been replaced with constant-time comparison methods throughout the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T18:11:00.159476+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 is not present in jetty.project 9.4.63.tuxcare0001. The vulnerability allowed disclosure of full filesystem paths through InvalidPathException messages when invalid characters were sent in HTTP requests. The upstream fix (commit 53e8bc2a636, dated 2018-05-22) was applied by Joakim Erdfelt and shipped in Jetty 9.4.12+. This fix was already present in the upstream release before Tu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 is not present in jetty.project 9.4.63.tuxcare0001. The vulnerability allowed disclosure of full filesystem paths through InvalidPathException messages when invalid characters were sent in HTTP requests. The upstream fix (commit 53e8bc2a636, dated 2018-05-22) was applied by Joakim Erdfelt and shipped in Jetty 9.4.12+. This fix was already present in the upstream release before Tu..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. Target version 9.4.63 is NOT AFFECTED by CVE-2018-12545. The vulnerability (DoS via excessive HTTP/2 SETTINGS frames) was fixed by upstream Jetty developers in 2019 (commits 508ad4aff91 and 5fc83c3d0c6). Both defense mechanisms\u2014(1) cumulative settings key counter limiting to 64 keys, and (2) rate control limiting to 128 events/second\u2014are present, active by default, and shipped in the upstream release that TuxCare onboarded in August 2026. The vulnerable pattern (unlimited SETTINGS frame processing) is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "Target version 9.4.63 is NOT AFFECTED by CVE-2018-12545. The vulnerability (DoS via excessive HTTP/2 SETTINGS frames) was fixed by upstream Jetty developers in 2019 (commits 508ad4aff91 and 5fc83c3d0c6). Both defense mechanisms\u2014(1) cumulative settings key counter limiting to 64 keys, and (2) rate control limiting to 128 events/second\u2014are present, active by default, and shipped in the upstream release that TuxCare onboarded in August 2026. The vulnerable pattern (unlimited SETTINGS frame processing) is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:12:00.140572+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 affects Jetty versions 9.4.15 and older with XSS in directory listings. The target (Jetty 9.4.63.tuxcare0001) contains the upstream fix that replaced the vulnerable getName() with getFileName() in directory listing generation. The fix extracts only the filename (last path segment) and properly URL-decodes it, preventing XSS through malicious paths. Fix commit 7b774d82e82 by joaki...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 affects Jetty versions 9.4.15 and older with XSS in directory listings. The target (Jetty 9.4.63.tuxcare0001) contains the upstream fix that replaced the vulnerable getName() with getFileName() in directory listing generation. The fix extracts only the filename (last path segment) and properly URL-decodes it, preventing XSS through malicious paths. Fix commit 7b774d82e82 by joaki..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 is not present in target version 9.4.63. The vulnerability allowed exposure of fully qualified file system paths in directory listings on Windows. The upstream fix (commit 7b774d82e82 by Joakim Erdfelt, 2019-04-15) was already included in the upstream Jetty release that TuxCare onboarded as version 9.4.58.1 in December 2025. The fix introduces a getFileName() method that extracts...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 is not present in target version 9.4.63. The vulnerability allowed exposure of fully qualified file system paths in directory listings on Windows. The upstream fix (commit 7b774d82e82 by Joakim Erdfelt, 2019-04-15) was already included in the upstream Jetty release that TuxCare onboarded as version 9.4.58.1 in December 2025. The fix introduces a getFileName() method that extracts..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:35:00.088029+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 is NOT present in the target. The vulnerability involved DefaultHandler revealing the fully qualified directory base resource location in 404 error responses by outputting context.toString(). The upstream fix (commit 04c99471) removed these context.toString() calls from the error page HTML. This fix was already present in Jetty 9.4.58.1, the upstream release that TuxCare onboarde...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 is NOT present in the target. The vulnerability involved DefaultHandler revealing the fully qualified directory base resource location in 404 error responses by outputting context.toString(). The upstream fix (commit 04c99471) removed these context.toString() calls from the error page HTML. This fix was already present in Jetty 9.4.58.1, the upstream release that TuxCare onboarde..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:16:26.818027+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Eclipse Jetty 9.4.63.tuxcare0001) is NOT affected by CVE-2019-17632. The vulnerability concerning unescaped exception messages in error responses was fixed by upstream commits 9e40fc9a6fb and cf0df6e3ffd (Issue #4334) before TuxCare onboarded this version. The ErrorHandler.java file contains comprehensive sanitization using StringUtil.sanitizeXmlString() for all exception...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 The target repository (Eclipse Jetty 9.4.63.tuxcare0001) is NOT affected by CVE-2019-17632. The vulnerability concerning unescaped exception messages in error responses was fixed by upstream commits 9e40fc9a6fb and cf0df6e3ffd (Issue #4334) before TuxCare onboarded this version. The ErrorHandler.java file contains comprehensive sanitization using StringUtil.sanitizeXmlString() for all exception..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. The target repository (Jetty 9.4.63.tuxcare0001) is not affected by CVE-2019-17638. The vulnerability involved a double-release of ByteBuffers in HTTP response header handling that could leak sensitive data between clients. The fix (commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba) was authored by upstream developer Greg Wilkins and was already present in the upstream Jetty 9.4.58.1 release that TuxCare onboarded. The vulnerable code pattern has been eliminated through proper buffer lifecycle management.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "The target repository (Jetty 9.4.63.tuxcare0001) is not affected by CVE-2019-17638. The vulnerability involved a double-release of ByteBuffers in HTTP response header handling that could leak sensitive data between clients. The fix (commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba) was authored by upstream developer Greg Wilkins and was already present in the upstream Jetty 9.4.58.1 release that TuxCare onboarded. The vulnerable code pattern has been eliminated through proper buffer lifecycle management.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-05T14:18:18.711143+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. The upstream fix was released in 9.4.35.v20201120, and version 9.4.63 is a later release of the same line. Advisories: GitHub GHSA-86wm-rrjm-8wh8 (fixed in 9.4.35.v20201120), NVD (fixed in 9.4.35), CVE record (last affected 9.4.34.v20201102), Snyk (fixed in 9.4.35.v20201120).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "The upstream fix was released in 9.4.35.v20201120, and version 9.4.63 is a later release of the same line. Advisories: GitHub GHSA-86wm-rrjm-8wh8 (fixed in 9.4.35.v20201120), NVD (fixed in 9.4.35), CVE record (last affected 9.4.34.v20201102), Snyk (fixed in 9.4.35.v20201120)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:28:51.823841+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 9.4.63.tuxcare0001 is not affected by CVE-2020-27223. The vulnerability involved an inefficient bubble-sort-like algorithm in QuotedQualityCSV.sort() that could cause O(n\u00b2) or worse time complexity when processing HTTP request headers with many quality parameters, leading to CPU-based DoS. The upstream Jetty project fixed this in version 9.4.37.v20210219 (commit 10e531756b9) by...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 9.4.63.tuxcare0001 is not affected by CVE-2020-27223. The vulnerability involved an inefficient bubble-sort-like algorithm in QuotedQualityCSV.sort() that could cause O(n\u00b2) or worse time complexity when processing HTTP request headers with many quality parameters, leading to CPU-based DoS. The upstream Jetty project fixed this in version 9.4.37.v20210219 (commit 10e531756b9) by..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. The target Jetty 9.4.63.tuxcare0001 is NOT AFFECTED by CVE-2021-28165. The vulnerability (CPU exhaustion from invalid large TLS frames >17408 bytes) was fixed in upstream commit 294b2ba02b6 by Simone Bordet on March 22, 2021. This fix was already present in the upstream release before TuxCare onboarded the codebase. The defense code in SslConnection.java lines 753-757 correctly checks buffer space before processing continuation, preventing the infinite loop that causes CPU exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "The target Jetty 9.4.63.tuxcare0001 is NOT AFFECTED by CVE-2021-28165. The vulnerability (CPU exhaustion from invalid large TLS frames >17408 bytes) was fixed in upstream commit 294b2ba02b6 by Simone Bordet on March 22, 2021. This fix was already present in the upstream release before TuxCare onboarded the codebase. The defense code in SslConnection.java lines 753-757 correctly checks buffer space before processing continuation, preventing the infinite loop that causes CPU exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2021-34428 is not present in target version 9.4.63. The upstream Jetty project fixed this session invalidation vulnerability in version 9.4.41.v20210516 (commit 087f486b by Jan Bartel on 2021-05-16). The fix wraps SessionListener.sessionDestroyed() calls in try-catch and moves session ID invalidation (invalidateAll) into a finally block, ensuring sessions are properly invalidated even when ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34428 is not present in target version 9.4.63. The upstream Jetty project fixed this session invalidation vulnerability in version 9.4.41.v20210516 (commit 087f486b by Jan Bartel on 2021-05-16). The fix wraps SessionListener.sessionDestroyed() calls in try-catch and moves session ID invalidation (invalidateAll) into a finally block, ensuring sessions are properly invalidated even when ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 affects version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "action_statement": "Vulnerability CVE-2022-2191 affects version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:31:54.284752+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target Jetty 9.4.63 is not affected by CVE-2023-26048. The fix for this vulnerability was already included in the upstream Jetty 9.4.51.v20230217 release, which predates this TuxCare version. The upstream fix commit c3021592218da289563987e6f7fbe05f8704b285 (authored by lachlan@webtide.com) is present in HEAD and was part of the upstream release that TuxCare onboarded at commit 9bc35a9fd4ead...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 9.4.63 is not affected by CVE-2023-26048. The fix for this vulnerability was already included in the upstream Jetty 9.4.51.v20230217 release, which predates this TuxCare version. The upstream fix commit c3021592218da289563987e6f7fbe05f8704b285 (authored by lachlan@webtide.com) is present in HEAD and was part of the upstream release that TuxCare onboarded at commit 9bc35a9fd4ead..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T14:59:40.093884+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 (cookie smuggling via semicolons in quoted cookie values) is not present in Jetty 9.4.63. The upstream vendor fix (commit 1be1401bafb4 by Greg Wilkins) shipped in jetty-9.4.51.v20230217 and was already included when TuxCare onboarded version 9.4.58.1. The fix in CookieCutter.java (lines 201-206) rejects cookies containing semicolons inside quoted values when RFC6265 compliance mo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via semicolons in quoted cookie values) is not present in Jetty 9.4.63. The upstream vendor fix (commit 1be1401bafb4 by Greg Wilkins) shipped in jetty-9.4.51.v20230217 and was already included when TuxCare onboarded version 9.4.58.1. The fix in CookieCutter.java (lines 201-206) rejects cookies containing semicolons inside quoted values when RFC6265 compliance mo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. Target version 9.4.63 is not affected by CVE-2024-13009. The vulnerability (improper buffer release on gzip decompression error) was fixed in upstream Jetty 9.4.57 via commit e3fa9466633db6bf36e0eb0d17e3de166c788ede by gregw@webtide.com on 2024-12-19. This fix was already present in the upstream release that TuxCare onboarded (the fix is an ancestor of the first TuxCare commit 9bc35a9fd4ead00a973a665a311c64119ed5b834). The target's HttpInput.java contains all the defensive changes: (1) _content is nulled after content.failed() in both fail() and addContent() methods to prevent buffer reuse, (2) !isError() check added before producing more content, and (3) direct _interceptor.readFrom() call without error-swallowing wrapper.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "Target version 9.4.63 is not affected by CVE-2024-13009. The vulnerability (improper buffer release on gzip decompression error) was fixed in upstream Jetty 9.4.57 via commit e3fa9466633db6bf36e0eb0d17e3de166c788ede by gregw@webtide.com on 2024-12-19. This fix was already present in the upstream release that TuxCare onboarded (the fix is an ancestor of the first TuxCare commit 9bc35a9fd4ead00a973a665a311c64119ed5b834). The target's HttpInput.java contains all the defensive changes: (1) _content is nulled after content.failed() in both fail() and addContent() methods to prevent buffer reuse, (2) !isError() check added before producing more content, and (3) direct _interceptor.readFrom() call without error-swallowing wrapper.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-10T04:15:11.464324+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because zero-byte body reads reach cleanup that returns the empty buffer to its pool. Request-body handling parses before checking for a zero-byte fill at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:327. Parsing releases the buffer when content references are zero at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:387, and cleanup clears the connection\u2019s buffer field and returns the empty buffer to the pool at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:224.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because zero-byte body reads reach cleanup that returns the empty buffer to its pool. Request-body handling parses before checking for a zero-byte fill at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:327. Parsing releases the buffer when content references are zero at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:387, and cleanup clears the connection\u2019s buffer field and returns the empty buffer to the pool at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:224."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Jetty 9.4.63 is not affected by CVE-2026-10051. The vulnerability exists in Jetty 12+ where HttpConnection._trailers is never reset between requests on persistent connections. Jetty 9.4.x has a fundamentally different architecture: trailers are stored in HttpChannelOverHttp and HttpChannel (not HttpConnection), and both fields are properly cleared via recycle() methods called after each request...",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 9.4.63 is not affected by CVE-2026-10051. The vulnerability exists in Jetty 12+ where HttpConnection._trailers is never reset between requests on persistent connections. Jetty 9.4.x has a fundamentally different architecture: trailers are stored in HttpChannelOverHttp and HttpChannel (not HttpConnection), and both fields are properly cleared via recycle() methods called after each request..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    }
  ]
}