{
  "@id": "urn:uuid:2b883f6d-d8ae-43fb-b9cb-df5ca22f0df1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 22,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T19:09:00.174611+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-28169 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2021-28169 affects Jetty versions before 9.4.41, 10.0.3, and 11.0.3. The target is version 11.0.26, which includes the upstream fix from commit 1c05b0bcb18 (authored by lachlan@webtide.com on May 13, 2021). This fix was already present in the upstream release 11.0.26 before TuxCare began maintaining this version. Both ConcatServlet and WelcomeFilter have been patched to prevent double URL-d...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28169"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28169 affects Jetty versions before 9.4.41, 10.0.3, and 11.0.3. The target is version 11.0.26, which includes the upstream fix from commit 1c05b0bcb18 (authored by lachlan@webtide.com on May 13, 2021). This fix was already present in the upstream release 11.0.26 before TuxCare began maintaining this version. Both ConcatServlet and WelcomeFilter have been patched to prevent double URL-d..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-36479 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-servlets. All 1 patch commits already exist in target branch",
      "vulnerability": {
        "name": "CVE-2023-36479"
      },
      "impact_statement": "All 1 patch commits already exist in target branch"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6762 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-servlets.",
      "vulnerability": {
        "name": "CVE-2024-6762"
      },
      "action_statement": "Vulnerability CVE-2024-6762 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-servlets."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T19:09:00.174611+00:00",
      "status_notes": "Vulnerability CVE-2024-9823 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2024-9823 affects Jetty's DoSFilter through unbounded session-based tracking that can exhaust memory. The target repository (Jetty 11.0.26-tuxcare.3) contains the upstream fix from October 2023 (commits 168d8715d41, 78f3b5c9fbc, de862c558b1 by gregw@webtide.com). This fix removes all session-based tracking mechanisms and replaces them with bounded IP-based tracking with scheduled cleanup. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-9823"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-9823 affects Jetty's DoSFilter through unbounded session-based tracking that can exhaust memory. The target repository (Jetty 11.0.26-tuxcare.3) contains the upstream fix from October 2023 (commits 168d8715d41, 78f3b5c9fbc, de862c558b1 by gregw@webtide.com). This fix removes all session-based tracking mechanisms and replaces them with bounded IP-based tracking with scheduled cleanup. T..."
    }
  ]
}