{
  "@id": "urn:uuid:ea75725d-7117-415e-9347-8b26f33fee65",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 30,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:16:00.061099+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:08:01.045470+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2006-6969 describes predictable session ID generation in Jetty versions before 4.2.27/5.1.12/6.0.2/6.1.0pre3 due to use of java.util.Random. The target (Jetty 9.4.64.tuxcare0001) is NOT AFFECTED. The vulnerable pattern is absent - the code uses SecureRandom (cryptographically secure RNG) by default since March 2016 (commit add04e8f by janb@webtide.com), shipped in the upstream release befor...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "not_affected \u2014 CVE-2006-6969 describes predictable session ID generation in Jetty versions before 4.2.27/5.1.12/6.0.2/6.1.0pre3 due to use of java.util.Random. The target (Jetty 9.4.64.tuxcare0001) is NOT AFFECTED. The vulnerable pattern is absent - the code uses SecureRandom (cryptographically secure RNG) by default since March 2016 (commit add04e8f by janb@webtide.com), shipped in the upstream release befor..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty 9.4.64 is not affected by CVE-2011-4461 (hash collision DoS via unlimited form parameters). The vulnerability pattern was eliminated by upstream commit 085c79d7d6c (Dec 2011) which introduced the maxFormKeys defense mechanism limiting form parameters to 1000 by default. This fix was already present in upstream release 9.4.58.1 that TuxCare onboarded, making it an upstream fix rathe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 9.4.64 is not affected by CVE-2011-4461 (hash collision DoS via unlimited form parameters). The vulnerability pattern was eliminated by upstream commit 085c79d7d6c (Dec 2011) which introduced the maxFormKeys defense mechanism limiting form parameters to 1000 by default. This fix was already present in upstream release 9.4.58.1 that TuxCare onboarded, making it an upstream fix rathe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T17:47:26.501853+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 9.4.64 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 9.4.64 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:29:31.146838+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9, allowing bypass of protected resources on Windows via escaped backslash characters in URLs. The target is Jetty 9.4.64.tuxcare0001. The upstream fix (commit 97af3d663fd by Joakim Erdfelt, May 2016) was already present in the upstream release that TuxCare onboarded. The fix adds logic to PathResource.checkAliasPath() that detects when Windo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9, allowing bypass of protected resources on Windows via escaped backslash characters in URLs. The target is Jetty 9.4.64.tuxcare0001. The upstream fix (commit 97af3d663fd by Joakim Erdfelt, May 2016) was already present in the upstream release that TuxCare onboarded. The fix adds logic to PathResource.checkAliasPath() that detects when Windo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7656 affects Jetty 9.4.x only in non-default configuration with RFC2616 compliance enabled. The target version 9.4.64.tuxcare0001 ships with RFC7230 compliance mode as default, which includes runtime validation that rejects HTTP requests with multiple Content-Length headers or conflicting Content-Length + Transfer-Encoding headers. This validation prevents request smuggling attacks in the default configuration. The fix was part of upstream Jetty's compliance mode system authored by upstream developers and shipped in the upstream 9.4.64 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "CVE-2017-7656 affects Jetty 9.4.x only in non-default configuration with RFC2616 compliance enabled. The target version 9.4.64.tuxcare0001 ships with RFC7230 compliance mode as default, which includes runtime validation that rejects HTTP requests with multiple Content-Length headers or conflicting Content-Length + Transfer-Encoding headers. This validation prevents request smuggling attacks in the default configuration. The fix was part of upstream Jetty's compliance mode system authored by upstream developers and shipped in the upstream 9.4.64 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7657 describes an integer overflow vulnerability in Jetty's chunked transfer-encoding parser where a large chunk size could overflow and be interpreted as a smaller value, enabling chunk body content to be misinterpreted as a pipelined HTTP request. The target version (9.4.64.tuxcare0001) contains an upstream vendor fix that prevents this vulnerability by using a `long` type for chunk length storage (instead of `int`), limiting chunk sizes to 16 hex digits, and checking for negative overflow after each multiplication. This fix was already present in the upstream release that TuxCare onboarded (commit 67a7e4368, authored by upstream developer Lachlan Roberts, shipped before TuxCare's first commit 97bdda83880). The vulnerable pattern (int overflow leading to chunk body misinterpretation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "impact_statement": "CVE-2017-7657 describes an integer overflow vulnerability in Jetty's chunked transfer-encoding parser where a large chunk size could overflow and be interpreted as a smaller value, enabling chunk body content to be misinterpreted as a pipelined HTTP request. The target version (9.4.64.tuxcare0001) contains an upstream vendor fix that prevents this vulnerability by using a `long` type for chunk length storage (instead of `int`), limiting chunk sizes to 16 hex digits, and checking for negative overflow after each multiplication. This fix was already present in the upstream release that TuxCare onboarded (commit 67a7e4368, authored by upstream developer Lachlan Roberts, shipped before TuxCare's first commit 97bdda83880). The vulnerable pattern (int overflow leading to chunk body misinterpretation) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7658 HTTP Request Smuggling vulnerability is not present in Jetty 9.4.64. The upstream fix (commit a285deea42fcab60d9edcf994e458c238a348b55 by Greg Wilkins) shipped in the upstream release before TuxCare onboarding. The fix adds validation to reject requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers, active by default in RFC7230 compliance mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "CVE-2017-7658 HTTP Request Smuggling vulnerability is not present in Jetty 9.4.64. The upstream fix (commit a285deea42fcab60d9edcf994e458c238a348b55 by Greg Wilkins) shipped in the upstream release before TuxCare onboarding. The fix adds validation to reject requests with multiple Content-Length headers or both Content-Length and Transfer-Encoding headers, active by default in RFC7230 compliance mode.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-9735 (timing channel attack in password comparison) is NOT present in Jetty 9.4.64. The target repository contains constant-time comparison methods (stringEquals/byteEquals) implemented in Credential.java, and all password/credential comparison code (Password.java, DigestAuthenticator.java, DigestAuthModule.java) uses these methods instead of the vulnerable String.equals()/equalsIgnoreCase(). The fixes were authored by upstream Jetty developers (simone.bordet@gmail.com, lachlan@webtide.com) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare maintenance activity.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 (timing channel attack in password comparison) is NOT present in Jetty 9.4.64. The target repository contains constant-time comparison methods (stringEquals/byteEquals) implemented in Credential.java, and all password/credential comparison code (Password.java, DigestAuthenticator.java, DigestAuthModule.java) uses these methods instead of the vulnerable String.equals()/equalsIgnoreCase(). The fixes were authored by upstream Jetty developers (simone.bordet@gmail.com, lachlan@webtide.com) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare maintenance activity.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T18:14:00.096888+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2018-12536 describes a path disclosure vulnerability in Jetty 9.x where InvalidPathException messages containing full server filesystem paths are exposed in error responses when handling malformed requests. The target (Jetty 9.4.64.tuxcare0001) is NOT AFFECTED because the upstream vendor fix (commit ad4dceb1c08) was already present in version 9.4.58.1 when TuxCare onboarded it. The fix sani...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 describes a path disclosure vulnerability in Jetty 9.x where InvalidPathException messages containing full server filesystem paths are exposed in error responses when handling malformed requests. The target (Jetty 9.4.64.tuxcare0001) is NOT AFFECTED because the upstream vendor fix (commit ad4dceb1c08) was already present in version 9.4.58.1 when TuxCare onboarded it. The fix sani..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2018-12545 affects Jetty 9.3.x and 9.4.x via unbounded HTTP/2 SETTINGS frame processing causing DoS through resource exhaustion. The target repository (Jetty 9.4.64) is NOT affected because the upstream fix was already present in the shipped release. The fix adds a maxSettingsKeys limit (default 64) enforced in SettingsBodyParser.onSetting() lines 198-205, plus broader RateControl mechanism (lines 228-229). All SETTINGS key accumulation paths go through this check; no bypass exists. Fix commit 9eca404da296f48f7f97eff44e7d1213415bf542 was authored by upstream developer simone.bordet@gmail.com and is an ancestor of TuxCare's first setup commit 6dac01534f5, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 affects Jetty 9.3.x and 9.4.x via unbounded HTTP/2 SETTINGS frame processing causing DoS through resource exhaustion. The target repository (Jetty 9.4.64) is NOT affected because the upstream fix was already present in the shipped release. The fix adds a maxSettingsKeys limit (default 64) enforced in SettingsBodyParser.onSetting() lines 198-205, plus broader RateControl mechanism (lines 228-229). All SETTINGS key accumulation paths go through this check; no bypass exists. Fix commit 9eca404da296f48f7f97eff44e7d1213415bf542 was authored by upstream developer simone.bordet@gmail.com and is an ancestor of TuxCare's first setup commit 6dac01534f5, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:14:52.759379+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10241 (XSS in directory listings) is not present in target version 9.4.64. The upstream fix by Joakim Erdfelt (commit 7b774d82e82, April 2019) was already included in the Jetty release that TuxCare onboarded. The vulnerable code pattern no longer exists in HEAD - the secure getFileName() method with proper URL decoding is used instead of the vulnerable getName() pattern.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 (XSS in directory listings) is not present in target version 9.4.64. The upstream fix by Joakim Erdfelt (commit 7b774d82e82, April 2019) was already included in the Jetty release that TuxCare onboarded. The vulnerable code pattern no longer exists in HEAD - the secure getFileName() method with proper URL decoding is used instead of the vulnerable getName() pattern."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 affects Eclipse Jetty's directory listing feature, which exposed full filesystem paths (including base resource directories) instead of just filenames. The upstream fix (commit 7b774d82e82) introduced a getFileName() method to extract only the filename portion, preventing path disclosure. This fix was already present in upstream Jetty 9.4.58.1, which TuxCare onboarded as their st...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 affects Eclipse Jetty's directory listing feature, which exposed full filesystem paths (including base resource directories) instead of just filenames. The upstream fix (commit 7b774d82e82) introduced a getFileName() method to extract only the filename portion, preventing path disclosure. This fix was already present in upstream Jetty 9.4.58.1, which TuxCare onboarded as their st..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:37:00.163435+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 is NOT present in jetty.project 9.4.64.tuxcare0001. The vulnerability involved information disclosure where DefaultHandler would reveal the configured fully qualified directory base resource location in 404 error responses via context.toString() output. This was fixed upstream by Joakim Erdfelt in commit 04c994712c0b29824633598cfe0bf709f3b96f09 (April 15, 2019) which removed the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 is NOT present in jetty.project 9.4.64.tuxcare0001. The vulnerability involved information disclosure where DefaultHandler would reveal the configured fully qualified directory base resource location in 404 error responses via context.toString() output. This was fixed upstream by Joakim Erdfelt in commit 04c994712c0b29824633598cfe0bf709f3b96f09 (April 15, 2019) which removed the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:17:00.498992+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 affects Jetty 9.4.21-23 where exception messages in error responses were not HTML-escaped, allowing XSS. The target (Jetty 9.4.64) is NOT AFFECTED because the upstream fix was already included in Jetty 9.4.24 (released November 2019), well before TuxCare onboarded version 9.4.58.1. All error output methods (writeErrorJson, writeErrorPageStacks, htmlRow, writeErrorPlain, writeErro...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 affects Jetty 9.4.21-23 where exception messages in error responses were not HTML-escaped, allowing XSS. The target (Jetty 9.4.64) is NOT AFFECTED because the upstream fix was already included in Jetty 9.4.24 (released November 2019), well before TuxCare onboarded version 9.4.58.1. All error output methods (writeErrorJson, writeErrorPageStacks, htmlRow, writeErrorPlain, writeErro..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2019-17638 (double-release of ByteBuffer in HTTP response header overflow) is NOT present in target version 9.4.64. The upstream fix commit ff8ae56fa93 (authored by gregw@webtide.com on 2020-06-03) was already included in the upstream release that TuxCare onboarded. The target code contains the complete defense: (1) header capacity validation occurs BEFORE buffer release, preventing release-then-throw pattern; (2) all buffer releases use releaseHeader()/releaseChunk() methods that null references after release, preventing double-release; (3) _chunk field moved from class-level to SendCallback scope, eliminating cross-request sharing risk.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "CVE-2019-17638 (double-release of ByteBuffer in HTTP response header overflow) is NOT present in target version 9.4.64. The upstream fix commit ff8ae56fa93 (authored by gregw@webtide.com on 2020-06-03) was already included in the upstream release that TuxCare onboarded. The target code contains the complete defense: (1) header capacity validation occurs BEFORE buffer release, preventing release-then-throw pattern; (2) all buffer releases use releaseHeader()/releaseChunk() methods that null references after release, preventing double-release; (3) _chunk field moved from class-level to SendCallback scope, eliminating cross-request sharing risk.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:35:59.588299+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 affects Jetty's GZIP request body handling when requests from different clients are multiplexed on persistent HTTP connections. The vulnerability allows unconsumed gzip-inflated request body data to leak into subsequent requests on the same connection, enabling request body injection attacks. The target repository (Jetty 9.4.64) is NOT AFFECTED because the upstream fix (commit 14...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 affects Jetty's GZIP request body handling when requests from different clients are multiplexed on persistent HTTP connections. The vulnerability allows unconsumed gzip-inflated request body data to leak into subsequent requests on the same connection, enabling request body injection attacks. The target repository (Jetty 9.4.64) is NOT AFFECTED because the upstream fix (commit 14..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:30:02.504031+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27223 is not present in the target. The vulnerability involved an inefficient O(n\u00b2) bubble-sort-like algorithm in QuotedQualityCSV.java that could cause CPU exhaustion when processing HTTP headers with many quality parameters. The upstream Jetty project fixed this in version 9.4.37.v20210219 (February 18, 2021, commit 10e531756b9) by replacing the sorting algorithm with an efficient O(...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27223 is not present in the target. The vulnerability involved an inefficient O(n\u00b2) bubble-sort-like algorithm in QuotedQualityCSV.java that could cause CPU exhaustion when processing HTTP headers with many quality parameters. The upstream Jetty project fixed this in version 9.4.37.v20210219 (February 18, 2021, commit 10e531756b9) by replacing the sorting algorithm with an efficient O(..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. The target repository (Jetty 9.4.64) is NOT affected by CVE-2021-28165. The vulnerability was fixed in upstream commit 294b2ba02b667548617a94cd99592110ac230add by Simone Bordet, which was already included in the upstream release before TuxCare onboarded the repository. The fix prevents infinite processing loops when handling oversized TLS frames by checking buffer space before attempting further reads.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "The target repository (Jetty 9.4.64) is NOT affected by CVE-2021-28165. The vulnerability was fixed in upstream commit 294b2ba02b667548617a94cd99592110ac230add by Simone Bordet, which was already included in the upstream release before TuxCare onboarded the repository. The fix prevents infinite processing loops when handling oversized TLS frames by checking buffer space before attempting further reads.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 9.4.62 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "Version 9.4.62 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-10T04:16:00.061099+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its buffer pool does not retain buffers in use, allowing unreleased buffers to be garbage collected instead of accumulating permanently. Acquisition removes buffers from the pool\u2019s queue and memory accounting at jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:181. The pool contract explicitly permits garbage collection of unreleased buffers at jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:35.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its buffer pool does not retain buffers in use, allowing unreleased buffers to be garbage collected instead of accumulating permanently. Acquisition removes buffers from the pool\u2019s queue and memory accounting at jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:181. The pool contract explicitly permits garbage collection of unreleased buffers at jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:35."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:30:54.500712+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target version 9.4.64 is not affected by CVE-2023-26048. The vulnerability was fixed in upstream Jetty 9.4.51.v20230217 (commit c3021592218), and that fix is present in version 9.4.64. Both defense mechanisms are implemented: (1) maximum part count limit (default 1000 parts) enforced in MultiPartFormInputStream.startPart() at lines 770-772, and (2) cumulative size limit (default 200KB) for part...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 Target version 9.4.64 is not affected by CVE-2023-26048. The vulnerability was fixed in upstream Jetty 9.4.51.v20230217 (commit c3021592218), and that fix is present in version 9.4.64. Both defense mechanisms are implemented: (1) maximum part count limit (default 1000 parts) enforced in MultiPartFormInputStream.startPart() at lines 770-772, and (2) cumulative size limit (default 200KB) for part..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T14:59:40.093884+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values with embedded semicolons) is NOT present in Jetty 9.4.64. The fix was already included in the upstream release before TuxCare's onboarding. The vulnerable pattern where quoted cookie values consume semicolons and subsequent cookies has been removed by upstream commit 1be1401bafb (Greg Wilkins, Feb 2023). The target's CookieCutter.java contains ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values with embedded semicolons) is NOT present in Jetty 9.4.64. The fix was already included in the upstream release before TuxCare's onboarding. The vulnerable pattern where quoted cookie values consume semicolons and subsequent cookies has been removed by upstream commit 1be1401bafb (Greg Wilkins, Feb 2023). The target's CookieCutter.java contains ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2024-13009 is not present in this target. The vulnerability concerns incorrect buffer release when gzip decompression fails, potentially allowing buffer reuse across requests. The fix (commit e3fa9466633) was authored by upstream Jetty developer Greg Wilkins on Dec 19, 2024 and shipped in upstream release 9.4.64. TuxCare onboarded version 9.4.58.1 (first TuxCare commit 6dac01534f5) which already contained this fix, and the current 9.4.64.tuxcare0001 inherits it. All defensive changes are present: buffer nullification in fail() and addContent() methods, additional isError() check in nextContent(), and removal of the vulnerable intercept() method. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "CVE-2024-13009 is not present in this target. The vulnerability concerns incorrect buffer release when gzip decompression fails, potentially allowing buffer reuse across requests. The fix (commit e3fa9466633) was authored by upstream Jetty developer Greg Wilkins on Dec 19, 2024 and shipped in upstream release 9.4.64. TuxCare onboarded version 9.4.58.1 (first TuxCare commit 6dac01534f5) which already contained this fix, and the current 9.4.64.tuxcare0001 inherits it. All defensive changes are present: buffer nullification in fail() and addContent() methods, additional isError() check in nextContent(), and removal of the vulnerable intercept() method. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-10T04:16:00.061099+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because empty request buffers are returned to the pool after zero-byte reads, preventing the memory leak. In jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:327, parsing follows filling before the loop exits on a zero-byte result. Parsing triggers cleanup at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:386, and releaseRequestBuffer() clears the connection\u2019s buffer field and returns the empty buffer to the pool at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:224.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because empty request buffers are returned to the pool after zero-byte reads, preventing the memory leak. In jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:327, parsing follows filling before the loop exits on a zero-byte result. Parsing triggers cleanup at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:386, and releaseRequestBuffer() clears the connection\u2019s buffer field and returns the empty buffer to the pool at jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:224."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Version 9.4.x uses a different architecture than the affected 11.x/12.x versions. The vulnerability requires a connection-scoped HttpConnection._trailers field that is never cleared between requests. Version 9.4.x instead uses HttpChannel-scoped _trailers that IS properly cleared in HttpChannel.recycle(), preventing cross-request trailer leakage.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Version 9.4.x uses a different architecture than the affected 11.x/12.x versions. The vulnerability requires a connection-scoped HttpConnection._trailers field that is never cleared between requests. Version 9.4.x instead uses HttpChannel-scoped _trailers that IS properly cleared in HttpChannel.recycle(), preventing cross-request trailer leakage."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    }
  ]
}