{
  "@id": "urn:uuid:c2bda5d8-fa66-43f2-befe-dc9815c0c356",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T19:09:00.174611+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.29.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.29.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-28169 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2021-28169 double URL-decoding vulnerability is NOT present in target version 11.0.29.tuxcare0004. The upstream fix (commit 1c05b0bcb18 by Lachlan Roberts) was already included in the upstream Jetty release before TuxCare onboarded version 11.0.26. Both ConcatServlet.java and WelcomeFilter.java contain the protective code that prevents double-decoding attacks: ConcatServlet passes the origi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28169"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28169 double URL-decoding vulnerability is NOT present in target version 11.0.29.tuxcare0004. The upstream fix (commit 1c05b0bcb18 by Lachlan Roberts) was already included in the upstream Jetty release before TuxCare onboarded version 11.0.26. Both ConcatServlet.java and WelcomeFilter.java contain the protective code that prevents double-decoding attacks: ConcatServlet passes the origi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.29.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.29.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-10-28T01:19:37.295409+00:00",
      "status_notes": "Vulnerability CVE-2023-36479 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty:jetty-servlets. Version 11.0.29 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2023-36479"
      },
      "impact_statement": "Version 11.0.29 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.29.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.29.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-10-28T01:19:37.295409+00:00",
      "status_notes": "Vulnerability CVE-2024-6762 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty:jetty-servlets.",
      "vulnerability": {
        "name": "CVE-2024-6762"
      },
      "action_statement": "Vulnerability CVE-2024-6762 affects version 11.0.29.tuxcare0004 of org.eclipse.jetty:jetty-servlets."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.29.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.29.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-02T19:09:00.174611+00:00",
      "status_notes": "Vulnerability CVE-2024-9823 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2024-9823 affects Jetty's DoSFilter session tracking mode, which could cause memory exhaustion via unbounded RateTracker accumulation. The upstream fix (commit 168d8715d41, PR #10748) removed session-based tracking entirely, using only IP-based tracking with scheduler-based expiration. This fix shipped in Jetty 11.0.18 and is fully present in target version 11.0.29.tuxcare0004. Session trac...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-9823"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-9823 affects Jetty's DoSFilter session tracking mode, which could cause memory exhaustion via unbounded RateTracker accumulation. The upstream fix (commit 168d8715d41, PR #10748) removed session-based tracking entirely, using only IP-based tracking with scheduler-based expiration. This fix shipped in Jetty 11.0.18 and is fully present in target version 11.0.29.tuxcare0004. Session trac..."
    }
  ]
}