{
  "@id": "urn:uuid:57522809-f0d9-4de3-aa13-d84e1f063550",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T19:10:00.166570+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2021-28169 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2021-28169 is NOT present in target Jetty 11.0.30. The vulnerability (double URL-decoding bypass in ConcatServlet, WelcomeFilter, and ResourceService) was fixed by upstream Eclipse Jetty in commit 1c05b0bcb181 (issue #6263), which shipped in Jetty 11.0.26. TuxCare onboarded from 11.0.26, inheriting the fix. All three affected files pass encoded paths (not pre-decoded paths) to RequestDispat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28169"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28169 is NOT present in target Jetty 11.0.30. The vulnerability (double URL-decoding bypass in ConcatServlet, WelcomeFilter, and ResourceService) was fixed by upstream Eclipse Jetty in commit 1c05b0bcb181 (issue #6263), which shipped in Jetty 11.0.26. TuxCare onboarded from 11.0.26, inheriting the fix. All three affected files pass encoded paths (not pre-decoded paths) to RequestDispat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-36479 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-servlets. Version 11.0.30 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2023-36479"
      },
      "impact_statement": "Version 11.0.30 is not affected by CVE-2023-36479: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6762 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-servlets. All 2 patch commits already exist in target branch",
      "vulnerability": {
        "name": "CVE-2024-6762"
      },
      "impact_statement": "All 2 patch commits already exist in target branch"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@11.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T19:10:00.166570+00:00",
      "status_notes": "Vulnerability CVE-2024-9823 does not affect version 11.0.30.tuxcare0001 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2024-9823 affects Jetty's DoSFilter session tracking mode, which allowed attackers to exhaust server memory by causing unbounded accumulation of RateTracker objects in HttpSession attributes. The target repository (Jetty 11.0.30.tuxcare0002) is NOT AFFECTED because the vulnerable session tracking code was completely removed by upstream commit 168d8715d4148dafe7f818c4bb01dcd0d6e2347f (author...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-9823"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-9823 affects Jetty's DoSFilter session tracking mode, which allowed attackers to exhaust server memory by causing unbounded accumulation of RateTracker objects in HttpSession attributes. The target repository (Jetty 11.0.30.tuxcare0002) is NOT AFFECTED because the vulnerable session tracking code was completely removed by upstream commit 168d8715d4148dafe7f818c4bb01dcd0d6e2347f (author..."
    }
  ]
}