{
  "@id": "urn:uuid:52720dbd-c046-4175-9662-aff473de1c39",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 31,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:05:28.850476+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-09T10:28:45.646681+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. Checked by hand: jetty.project has no upstream fix for this CVE (the fix is in the Jetty 6 code base, 2006); this version's session-ID generator DefaultSessionIdManager uses SecureRandom, and the tree has no Jetty 6 (org.mortbay) code. Advisories: GitHub says fixed in 6.1.0pre3 (Jetty 4 to 6), and this version is on a newer line; NVD lists only releases 4.2.9 to 6.1.0_pre2. Confirmed not affected by the Java ELS team review on 2026-11-06.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "impact_statement": "Checked by hand: jetty.project has no upstream fix for this CVE (the fix is in the Jetty 6 code base, 2006); this version's session-ID generator DefaultSessionIdManager uses SecureRandom, and the tree has no Jetty 6 (org.mortbay) code. Advisories: GitHub says fixed in 6.1.0pre3 (Jetty 4 to 6), and this version is on a newer line; NVD lists only releases 4.2.9 to 6.1.0_pre2. Confirmed not affected by the Java ELS team review on 2026-11-06."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2011-4461 describes a hash collision DoS vulnerability in Jetty 8.1.0.RC2 and earlier where unbounded form parameters cause CPU exhaustion. The target (Jetty 9.4.65.tuxcare0001) contains the upstream fix (commit 085c79d7d6c by Greg Wilkins, December 2011) which adds a maxFormKeys limit (default 1000) to bound hash table operations during form parameter parsing. This fix was already present ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "impact_statement": "not_affected \u2014 CVE-2011-4461 describes a hash collision DoS vulnerability in Jetty 8.1.0.RC2 and earlier where unbounded form parameters cause CPU exhaustion. The target (Jetty 9.4.65.tuxcare0001) contains the upstream fix (commit 085c79d7d6c by Greg Wilkins, December 2011) which adds a maxFormKeys limit (default 1000) to bound hash table operations during form parameter parsing. This fix was already present ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-06T17:48:00.459476+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 9.4.65 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 3e7b5f0f, 4df5647f). Version 9.4.65 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-ghgj-3xqr-6jfm (affected up to 9.2.9.v20150224), NVD (affected up to 9.3.0-m1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:31:44.936589+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, where escaped backslash characters (%5C) in URLs could bypass path normalization and security constraints. The target repository (Jetty 9.4.65.tuxcare0001) contains the upstream fix from May 2016 (commit 97af3d663fd). The fix was already present in the upstream release that TuxCare onboarded, making the target not affected. The ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-4800 affects Eclipse Jetty 9.3.x before 9.3.9 on Windows, where escaped backslash characters (%5C) in URLs could bypass path normalization and security constraints. The target repository (Jetty 9.4.65.tuxcare0001) contains the upstream fix from May 2016 (commit 97af3d663fd). The fix was already present in the upstream release that TuxCare onboarded, making the target not affected. The ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. The target Jetty 9.4.65 is not affected by CVE-2017-7656. The vulnerability's defense logic (rejecting HTTP requests with conflicting Content-Length/Transfer-Encoding headers) was already present in the upstream release via commit 890c0b26cb8 (October 2019) by Joakim Erdfelt. The default RFC7230 compliance mode includes protections against multiple Content-Length headers and simultaneous Transfer-Encoding + Content-Length headers. While RFC2616_LEGACY mode excludes these protections (matching the CVE's \"non-default configuration\" scenario), the default configuration is safe.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "impact_statement": "The target Jetty 9.4.65 is not affected by CVE-2017-7656. The vulnerability's defense logic (rejecting HTTP requests with conflicting Content-Length/Transfer-Encoding headers) was already present in the upstream release via commit 890c0b26cb8 (October 2019) by Joakim Erdfelt. The default RFC7230 compliance mode includes protections against multiple Content-Length headers and simultaneous Transfer-Encoding + Content-Length headers. While RFC2616_LEGACY mode excludes these protections (matching the CVE's \"non-default configuration\" scenario), the default configuration is safe.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605; > 8.2.0.v20160908, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-7657 (integer overflow in HTTP chunk size parsing) is NOT present in target version 9.4.65. The vulnerability was fixed in upstream jetty-9.4.11 (May 2018) by commit a285deea42f, which added MAX_CHUNK_LENGTH bounds checking before chunk length multiplication. This fix was already present in jetty-9.4.58.1 when TuxCare onboarded the project (Dec 2025). The current version (9.4.65) has a refactored implementation (commit 93ca05a3f67, March 2026) that prevents overflow via digit limit + negative check. Both are upstream fixes; no TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "impact_statement": "CVE-2017-7657 (integer overflow in HTTP chunk size parsing) is NOT present in target version 9.4.65. The vulnerability was fixed in upstream jetty-9.4.11 (May 2018) by commit a285deea42f, which added MAX_CHUNK_LENGTH bounds checking before chunk length multiplication. This fix was already present in jetty-9.4.58.1 when TuxCare onboarded the project (Dec 2025). The current version (9.4.65) has a refactored implementation (commit 93ca05a3f67, March 2026) that prevents overflow via digit limit + negative check. Both are upstream fixes; no TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (< 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. The target Jetty 9.4.65 is NOT AFFECTED by CVE-2017-7658 (HTTP Request Smuggling via duplicate Content-Length or Content-Length + Transfer-Encoding headers). The vulnerability was fixed by upstream commit a285deea42f (\"Issue #2529 RFC2616 vs RFC7230 cleanup\") authored by Greg Wilkins (gregw@webtide.com), which shipped in the upstream Jetty release that TuxCare onboarded. The fix introduces `_hasContentLength` and `_hasTransferEncoding` boolean flags and validates headers in HttpParser.handleKnownHeaders() to reject requests with multiple Content-Length headers or the combination of Content-Length + Transfer-Encoding: chunked. The default compliance mode (RFC7230) enforces these protections, preventing HTTP request smuggling attacks that could bypass authorization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "impact_statement": "The target Jetty 9.4.65 is NOT AFFECTED by CVE-2017-7658 (HTTP Request Smuggling via duplicate Content-Length or Content-Length + Transfer-Encoding headers). The vulnerability was fixed by upstream commit a285deea42f (\"Issue #2529 RFC2616 vs RFC7230 cleanup\") authored by Greg Wilkins (gregw@webtide.com), which shipped in the upstream Jetty release that TuxCare onboarded. The fix introduces `_hasContentLength` and `_hasTransferEncoding` boolean flags and validates headers in HttpParser.handleKnownHeaders() to reject requests with multiple Content-Length headers or the combination of Content-Length + Transfer-Encoding: chunked. The default compliance mode (RFC7230) enforces these protections, preventing HTTP request smuggling attacks that could bypass authorization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.2.25.v20180606; >= 9.3.0, < 9.3.24.v20180605; >= 9.4.0, < 9.4.11.v20180605), NVD (<= 9.2.26; >= 9.3.0, < 9.3.24; >= 9.4.0, < 9.4.11), Snyk (> 8.2.0.v20160908, < 9.2.25.v20180606; >= 9.3.0.M0, < 9.3.24.v20180605; >= 9.4.0.M0, < 9.4.11.v20180605)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2017-9735 timing channel vulnerability is NOT present in Jetty 9.4.65. The vulnerable pattern (non-constant-time password comparison using String.equals()) was replaced with constant-time comparison methods (stringEquals/byteEquals) by upstream commit 042f325f1cd authored by simone.bordet@gmail.com on 2017-05-16. This fix shipped in the upstream release that TuxCare onboarded (first TuxCare commit 07bc6a30d3e on 2025-12-12). All password/credential comparison paths use the timing-safe methods: Password.check() at lines 100/103, Password.equals() at lines 121/124, Crypt.check() at line 158, MD5.check() at line 217, DigestAuthenticator at line 676, DigestAuthModule at line 349.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "impact_statement": "CVE-2017-9735 timing channel vulnerability is NOT present in Jetty 9.4.65. The vulnerable pattern (non-constant-time password comparison using String.equals()) was replaced with constant-time comparison methods (stringEquals/byteEquals) by upstream commit 042f325f1cd authored by simone.bordet@gmail.com on 2017-05-16. This fix shipped in the upstream release that TuxCare onboarded (first TuxCare commit 07bc6a30d3e on 2025-12-12). All password/credential comparison paths use the timing-safe methods: Password.check() at lines 100/103, Password.equals() at lines 121/124, Crypt.check() at line 158, MD5.check() at line 217, DigestAuthenticator at line 676, DigestAuthModule at line 349.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.6.v20170531; >= 9.3.0, < 9.3.20.v20170531; < 9.2.22.v20170606), NVD (< 9.2.22; >= 9.3.0, < 9.3.20; >= 9.4.0, < 9.4.6), Snyk (< 9.2.22.v20170606; >= 9.3.0.M0, < 9.3.20.v20170531; >= 9.4.0.M0, < 9.4.6.v20170531)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T18:17:29.066715+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target is not affected by CVE-2018-12536. The vulnerability (exposing full filesystem paths in InvalidPathException error messages) is not present because the upstream fix was already included in the Jetty 9.4.58+ release that TuxCare onboarded. The fix wraps all path-related exceptions in ResourceContentFactory.getContent() to sanitize error messages, removing full filesystem paths and retaini...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 Target is not affected by CVE-2018-12536. The vulnerability (exposing full filesystem paths in InvalidPathException error messages) is not present because the upstream fix was already included in the Jetty 9.4.58+ release that TuxCare onboarded. The fix wraps all path-related exceptions in ResourceContentFactory.getContent() to sanitize error messages, removing full filesystem paths and retaini..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2018-12545 is not present in the target. The vulnerable pattern (unbounded SETTINGS frame key processing) was fixed in upstream Jetty commit 9eca404da29 which shipped in release 9.4.58.1 before TuxCare onboarded this repository. The defense code exists in SettingsBodyParser lines 198-205, enforcing a configurable limit (default 64) on setting keys and rejecting frames that exceed it with ENHANCE_YOUR_CALM_ERROR.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "impact_statement": "CVE-2018-12545 is not present in the target. The vulnerable pattern (unbounded SETTINGS frame key processing) was fixed in upstream Jetty commit 9eca404da29 which shipped in release 9.4.58.1 before TuxCare onboarded this repository. The defense code exists in SettingsBodyParser lines 198-205, enforcing a configurable limit (default 64) on setting keys and rejecting frames that exceed it with ENHANCE_YOUR_CALM_ERROR.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.12.v20180830; >= 9.3.0, < 9.3.25.v20180904), NVD (= 9.3.0-20150601; = 9.3.0-20150608; = 9.3.0-20150612; = 9.3.0-maintenance0; = 9.3.0-maintenance1; = 9.3.0-maintenance2; = 9.3.0-rc0; = 9.3.0-rc1; = 9.3.1-20150714; = 9.3.2-20150730; = 9.3.3-20150825; = 9.3.3-20150827; = 9.3.4-20151005; = 9.3.4-20151007; = 9.3.4-rc0; = 9.3.4-rc1; = 9.3.5-20151012; = 9.3.6-20151106; = 9.3.7-20160115; = 9.3.7-rc0; = 9.3.7-rc1; = 9.3.8-20160311; = 9.3.8-20160314; = 9.3.8-rc0; = 9.3.9-20160517; = 9.3.9-maintenance_0; = 9.3.9-maintenance_1; = 9.3.10-20160621; = 9.3.10-maintenance_0; = 9.3.11-20160721; = 9.3.11-maintenance_0; = 9.3.12-20160915; = 9.3.13-20161014; = 9.3.13-maintenance_0; = 9.3.14-20161028; = 9.3.15-20161220; = 9.3.16-20170119; = 9.3.16-20170120; = 9.3.17-20170317; = 9.3.17-rc0; = 9.3.18-20170406; = 9.3.19-20170502; = 9.3.20-20170531; = 9.3.21-20170918; = 9.3.21-maintenance_0; = 9.3.21-rc0; = 9.3.22-20171030; = 9.3.23-20180228; = 9.3.24-20180605; = 9.4.0-20161207; = 9.4.0-20161208; = 9.4.0-20180619; = 9.4.0-maintenance_0; = 9.4.0-maintenance_1; = 9.4.0-rc0; = 9.4.0-rc1; = 9.4.0-rc2; = 9.4.0-rc3; = 9.4.1-20170120; = 9.4.1-20180619; = 9.4.2-20170220; = 9.4.2-20180619; = 9.4.3-20170317; = 9.4.3-20180619; = 9.4.4-20170410; = 9.4.4-20170414; = 9.4.4-20180619; = 9.4.5-20170502; = 9.4.5-20180619; = 9.4.6-20170531; = 9.4.6-20180619; = 9.4.7-20170914; = 9.4.7-20180619; = 9.4.7-rc0; = 9.4.8-20171121; = 9.4.8-20180619; = 9.4.9-20180320; = 9.4.10-20180503; = 9.4.10-rc0; = 9.4.10-rc1; = 9.4.11-20180605; = 9.4.12-rc0; = 9.4.12-rc1; = 9.4.12-rc2), Snyk (<= 0; >= 9.3.0.M0, < 9.4.12.v20180830)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:17:57.385112+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 9.4.65) is not affected by CVE-2019-10241. The vulnerability pattern (XSS through URL-encoded filenames in directory listings) is not present because an upstream fix (commit 3d028ab2ca7) was already included in the upstream release that TuxCare started maintaining. The fix adds proper URL decoding via the getFileName() method before inserting filenames into HTML dir...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 9.4.65) is not affected by CVE-2019-10241. The vulnerability pattern (XSS through URL-encoded filenames in directory listings) is not present because an upstream fix (commit 3d028ab2ca7) was already included in the upstream release that TuxCare started maintaining. The fix adds proper URL decoding via the getFileName() method before inserting filenames into HTML dir..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10246 affects Jetty servers on Windows where directory listings could expose the fully qualified base resource directory path. The vulnerability was fixed in upstream commit 7b774d82e82 (2019-04-15) which introduced the getFileName() method to extract only the filename component instead of the full path. This fix was already present in upstream release 9.4.58.1, which predates the TuxC...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10246 affects Jetty servers on Windows where directory listings could expose the fully qualified base resource directory path. The vulnerability was fixed in upstream commit 7b774d82e82 (2019-04-15) which introduced the getFileName() method to extract only the filename component instead of the full path. This fix was already present in upstream release 9.4.58.1, which predates the TuxC..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T16:40:31.644157+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-10247 affects Jetty versions 9.4.16 and older. The target version 9.4.65 already contains the upstream fix (commit 04c994712c0) that was applied in April 2019 and shipped in version 9.4.17. The vulnerable code pattern (calling context.toString() to output base resource paths in 404 error pages) is not present in the current codebase. The fix was authored by upstream developer Joakim Er...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 affects Jetty versions 9.4.16 and older. The target version 9.4.65 already contains the upstream fix (commit 04c994712c0) that was applied in April 2019 and shipped in version 9.4.17. The vulnerable code pattern (calling context.toString() to output base resource paths in 404 error pages) is not present in the current codebase. The fix was authored by upstream developer Joakim Er..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:18:00.143361+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2019-17632 affects Eclipse Jetty versions 9.4.21-9.4.23 where exception messages in error response content (text/html and text/json) are not escaped, enabling XSS attacks. The target version 9.4.65.tuxcare0001 is NOT affected because it contains the complete upstream fix (commits 9e40fc9a6fb and cf0df6e3ffd by Joakim Erdfelt from Nov 2019) that sanitizes all exception message output. All ex...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17632 affects Eclipse Jetty versions 9.4.21-9.4.23 where exception messages in error response content (text/html and text/json) are not escaped, enabling XSS attacks. The target version 9.4.65.tuxcare0001 is NOT affected because it contains the complete upstream fix (commits 9e40fc9a6fb and cf0df6e3ffd by Joakim Erdfelt from Nov 2019) that sanitizes all exception message output. All ex..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. CVE-2019-17638 affects Eclipse Jetty 9.4.27 to 9.4.29. The target is Jetty 9.4.65.tuxcare0001. The vulnerability involves a double-release of ByteBuffer when handling oversized response headers, leading to data leakage between clients. The upstream fix (commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba) was already present in upstream release 9.4.58.1, which TuxCare onboarded as the base. The fix reorders HEADER_OVERFLOW handling to check size limits BEFORE releasing buffers, preventing the double-release scenario. Analysis confirms the fix is present at HttpConnection.java:772-776 with proper helper methods releaseHeader() and releaseChunk() that null references after release. Verdict: not_affected because the vulnerable pattern was removed by the upstream vendor before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "impact_statement": "CVE-2019-17638 affects Eclipse Jetty 9.4.27 to 9.4.29. The target is Jetty 9.4.65.tuxcare0001. The vulnerability involves a double-release of ByteBuffer when handling oversized response headers, leading to data leakage between clients. The upstream fix (commit ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba) was already present in upstream release 9.4.58.1, which TuxCare onboarded as the base. The fix reorders HEADER_OVERFLOW handling to check size limits BEFORE releasing buffers, preventing the double-release scenario. Analysis confirms the fix is present at HttpConnection.java:772-776 with proper helper methods releaseHeader() and releaseChunk() that null references after release. Verdict: not_affected because the vulnerable pattern was removed by the upstream vendor before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.27, < 9.4.30.v20200611), NVD (= 9.4.27-20200227; = 9.4.28-20200408; = 9.4.29-20200521), Snyk (>= 9.4.27.v20200227, < 9.4.30.v20200611)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:36:34.527535+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2020-27218 (GZIP request body inflation vulnerability causing body confusion on persistent connections) is NOT present in this target. The complete fix from upstream Jetty issue #5605 (commit 14f94f738df, dated 2020-11-18) was already included in the upstream release before TuxCare onboarded version 9.4.58.1 on 2025-12-12. All defense components are present and functional: GzipHttpInputInte...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-27218 (GZIP request body inflation vulnerability causing body confusion on persistent connections) is NOT present in this target. The complete fix from upstream Jetty issue #5605 (commit 14f94f738df, dated 2020-11-18) was already included in the upstream release before TuxCare onboarded version 9.4.58.1 on 2025-12-12. All defense components are present and functional: GzipHttpInputInte..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:29:14.785598+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 The target repository (Jetty 9.4.65.tuxcare0001) is NOT AFFECTED by CVE-2020-27223. The vulnerable algorithmic complexity issue in QuotedQualityCSV has been fixed with an upstream patch that was already present in the upstream release before TuxCare onboarding. The code uses an efficient O(n log n) comparison-based sort with a QualityValue wrapper class, eliminating the DoS vulnerability from e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 9.4.65.tuxcare0001) is NOT AFFECTED by CVE-2020-27223. The vulnerable algorithmic complexity issue in QuotedQualityCSV has been fixed with an upstream patch that was already present in the upstream release before TuxCare onboarding. The code uses an efficient O(n log n) comparison-based sort with a QualityValue wrapper class, eliminating the DoS vulnerability from e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T11:38:59.216006+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. Target version 9.4.65.tuxcare0001 is NOT AFFECTED by CVE-2021-28165. The vulnerability (infinite loop causing CPU exhaustion when processing oversized TLS frames) was fixed in upstream Eclipse Jetty version 9.4.39.v20210325 (March 2021) via commit 294b2ba02b6 by Simone Bordet. The fix reorders the BUFFER_UNDERFLOW case logic to check buffer space BEFORE attempting to continue processing, preventing the infinite loop. TuxCare onboarded Jetty starting from version 9.4.58.1, which already contained this upstream fix. The defensive code is present at SslConnection.java lines 753-757.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "impact_statement": "Target version 9.4.65.tuxcare0001 is NOT AFFECTED by CVE-2021-28165. The vulnerability (infinite loop causing CPU exhaustion when processing oversized TLS frames) was fixed in upstream Eclipse Jetty version 9.4.39.v20210325 (March 2021) via commit 294b2ba02b6 by Simone Bordet. The fix reorders the BUFFER_UNDERFLOW case logic to check buffer space BEFORE attempting to continue processing, preventing the infinite loop. TuxCare onboarded Jetty starting from version 9.4.58.1, which already contained this upstream fix. The defensive code is present at SslConnection.java lines 753-757.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), NVD (>= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2), Snyk (>= 7.2.2.v20101205, < 9.4.39.v20210325; >= 10.0.0.alpha0, < 10.0.2; >= 11.0.0.alpha0, < 11.0.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:01:01.522418+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 9.4.62 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "Version 9.4.62 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-10T04:16:00.061099+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its buffer pool does not retain acquired buffers, so failed TLS connections do not cause permanent pool retention. Acquisition allocates a buffer or removes it from the free queue at jetty-io/src/main/java/org/eclipse/jetty/io/ArrayByteBufferPool.java:123. Unreleased buffers are garbage-collected, as documented at jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:35.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its buffer pool does not retain acquired buffers, so failed TLS connections do not cause permanent pool retention. Acquisition allocates a buffer or removes it from the free queue at jetty-io/src/main/java/org/eclipse/jetty/io/ArrayByteBufferPool.java:123. Unreleased buffers are garbage-collected, as documented at jetty-io/src/main/java/org/eclipse/jetty/io/ByteBufferPool.java:35."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:32:58.011211+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Target Jetty 9.4.65.tuxcare0001 is NOT AFFECTED by CVE-2023-26048. The vulnerability pattern (unbounded multipart part count and unbounded form parameter content size leading to OutOfMemoryError) is not present because the fix was already shipped in the upstream release that TuxCare onboarded. Both defense mechanisms are present: (1) part count limit with DEFAULT_MAX_FORM_KEYS=1000, and (2) cum...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 9.4.65.tuxcare0001 is NOT AFFECTED by CVE-2023-26048. The vulnerability pattern (unbounded multipart part count and unbounded form parameter content size leading to OutOfMemoryError) is not present because the fix was already shipped in the upstream release that TuxCare onboarded. Both defense mechanisms are present: (1) part count limit with DEFAULT_MAX_FORM_KEYS=1000, and (2) cum..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T14:59:00.074352+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 CVE-2023-26049 describes a cookie smuggling vulnerability where Jetty's cookie parser incorrectly treats semicolons inside double-quoted cookie values as part of the value, allowing attackers to embed protected cookies (like HttpOnly JSESSIONID) within other cookies for exfiltration or policy bypass. The target (Jetty 9.4.65) is NOT affected because the upstream vendor fix (commit 1be1401bafb b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 describes a cookie smuggling vulnerability where Jetty's cookie parser incorrectly treats semicolons inside double-quoted cookie values as part of the value, allowing attackers to embed protected cookies (like HttpOnly JSESSIONID) within other cookies for exfiltration or policy bypass. The target (Jetty 9.4.65) is NOT affected because the upstream vendor fix (commit 1be1401bafb b..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. Target Eclipse Jetty 9.4.65 is NOT AFFECTED by CVE-2024-13009. The vulnerability (buffer incorrectly released on gzip decompression error, leading to data corruption/sharing between requests) is not present because the upstream fix (commit e3fa9466633db6bf36e0eb0d17e3de166c788ede by Greg Wilkins) was already included in the upstream release that TuxCare onboarded. All defense mechanisms from the patch are present: buffer nullification on error (lines 187-188, 597-598), error state checking (line 382), direct interceptor calls (line 466), and removal of the vulnerable intercept() wrapper method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "impact_statement": "Target Eclipse Jetty 9.4.65 is NOT AFFECTED by CVE-2024-13009. The vulnerability (buffer incorrectly released on gzip decompression error, leading to data corruption/sharing between requests) is not present because the upstream fix (commit e3fa9466633db6bf36e0eb0d17e3de166c788ede by Greg Wilkins) was already included in the upstream release that TuxCare onboarded. All defense mechanisms from the patch are present: buffer nullification on error (lines 187-188, 597-598), error state checking (line 382), direct interceptor calls (line 466), and removal of the vulnerable intercept() wrapper method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.0, < 9.4.57.v20241219), NVD (>= 9.4.0, < 9.4.57), cve.org (>= 9.4.0, <= 9.4.56), Snyk (>= 9.4.0.M0, < 9.4.57.v20241219)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-10T04:16:00.061099+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because zero-byte request-body reads release empty buffers instead of leaking them. In jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:260 and HttpConnection.java:327, both read paths parse the buffer before stopping on a zero-byte result. Parsing calls cleanup when no content references remain (HttpConnection.java:387), and cleanup clears the connection\u2019s buffer field and returns the empty buffer to the pool (HttpConnection.java:224).",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because zero-byte request-body reads release empty buffers instead of leaking them. In jetty-server/src/main/java/org/eclipse/jetty/server/HttpConnection.java:260 and HttpConnection.java:327, both read paths parse the buffer before stopping on a zero-byte result. Parsing calls cleanup when no content references remain (HttpConnection.java:387), and cleanup clears the connection\u2019s buffer field and returns the empty buffer to the pool (HttpConnection.java:224)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:01:01.522418+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 9.4.60 is not vulnerable. Summary: The target repository (Jetty 9.4.60.tuxcare0001) already has the CVE-2024-8184 fix applied. The ThreadLimitHandler uses atomic reference counting with ConcurrentHashMap.compute() methods instead of the vulnerable get+putIfAbsent pattern. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:01:01.522418+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. not_affected \u2014 Version 9.4.x uses a different architecture than the affected 11.x/12.x versions. The vulnerability requires a connection-scoped HttpConnection._trailers field that is never cleared between requests. Version 9.4.x instead uses HttpChannel-scoped _trailers that IS properly cleared in HttpChannel.recycle(), preventing cross-request trailer leakage.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Version 9.4.x uses a different architecture than the affected 11.x/12.x versions. The vulnerability requires a connection-scoped HttpConnection._trailers field that is never cleared between requests. Version 9.4.x instead uses HttpChannel-scoped _trailers that IS properly cleared in HttpChannel.recycle(), preventing cross-request trailer leakage."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:01:01.522418+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:01:01.522418+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server. Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 9.4.60 is not vulnerable. Summary: CVE-2026-1605 does not apply to Jetty 9.4.60. The vulnerability is specific to Jetty 12.x architecture which uses different classes and lifecycle management. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:35:44.733301+00:00",
      "status_notes": "Vulnerability CVE-2026-18660 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-18660"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:01:01.522418+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:01:01.522418+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:35:44.733301+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:35:44.733301+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:35:44.733301+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-server.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    }
  ]
}