{
  "@id": "urn:uuid:efd3cb1a-5282-46db-8d6e-a8a2d8e3722c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T19:10:00.166570+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-28169 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-servlets. Version 10.0.28 is not vulnerable. Summary: CVE-2021-28169 has been patched in the target repository. The fix was applied in Jetty version 9.4.41/10.0.3/11.0.3 (May 2021), and the target is running version 10.0.28 (March 2026). The double encoding vulnerability in ConcatServlet has been mitigated. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28169"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: CVE-2021-28169 has been patched in the target repository. The fix was applied in Jetty version 9.4.41/10.0.3/11.0.3 (May 2021), and the target is running version 10.0.28 (March 2026). The double encoding vulnerability in ConcatServlet has been mitigated. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-36479 affects version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-servlets.",
      "vulnerability": {
        "name": "CVE-2023-36479"
      },
      "action_statement": "Vulnerability CVE-2023-36479 affects version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-servlets."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6762 affects version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-servlets.",
      "vulnerability": {
        "name": "CVE-2024-6762"
      },
      "action_statement": "Vulnerability CVE-2024-6762 affects version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-servlets."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:10:00.166570+00:00",
      "status_notes": "Vulnerability CVE-2024-9823 does not affect version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 Target version 10.0.32 is NOT AFFECTED. The vulnerable session-based tracking mechanism that allowed unbounded memory growth has been completely removed. The upstream vendor (Eclipse Jetty) applied the fix in commit 168d8715d41 (October 2023), which was already included in the 10.0.32 release that TuxCare onboarded (December 2025). The fix removes session-based tracking entirely and ensures all...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-9823"
      },
      "impact_statement": "not_affected \u2014 Target version 10.0.32 is NOT AFFECTED. The vulnerable session-based tracking mechanism that allowed unbounded memory growth has been completely removed. The upstream vendor (Eclipse Jetty) applied the fix in commit 168d8715d41 (October 2023), which was already included in the 10.0.32 release that TuxCare onboarded (December 2025). The fix removes session-based tracking entirely and ensures all..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-servlets.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-servlets.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@10.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@10.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 10.0.32.tuxcare0001 of org.eclipse.jetty:jetty-servlets.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    }
  ]
}