{
  "@id": "urn:uuid:5fdb760c-f581-435e-93dc-8735d1b7193a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:05:28.850476+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:01:01.522418+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "action_statement": "Vulnerability CVE-2020-27216 affects version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T03:55:19.429064+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164 affected Jetty 9.4.37-9.4.38. The target at 9.4.65 contains the upstream fix from 9.4.39 (released March 2021). The fix normalizes ambiguous URI segments via URIUtil.canonicalPath() in HttpURI.java line 869, preventing %2e-encoded path traversal to WEB-INF. TuxCare onboarded from 9.4.58.1 which already had this upstream fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164 affected Jetty 9.4.37-9.4.38. The target at 9.4.65 contains the upstream fix from 9.4.39 (released March 2021). The fix normalizes ambiguous URI segments via URIUtil.canonicalPath() in HttpURI.java line 869, preventing %2e-encoded path traversal to WEB-INF. TuxCare onboarded from 9.4.58.1 which already had this upstream fix."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T03:43:55.008598+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 affects Jetty versions before 9.4.43, allowing encoded URI paths (%u002e, %00) to bypass security constraints and access WEB-INF resources. The target repository is Jetty 9.4.65.tuxcare0001. The fix commit f045b5a3bad from upstream developer Simone Bordet is present in HEAD. This fix was included in upstream Jetty 9.4.43 (June 2021), before TuxCare onboarded version 9.4.58.1. All...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 affects Jetty versions before 9.4.43, allowing encoded URI paths (%u002e, %00) to bypass security constraints and access WEB-INF resources. The target repository is Jetty 9.4.65.tuxcare0001. The fix commit f045b5a3bad from upstream developer Simone Bordet is present in HEAD. This fix was included in upstream Jetty 9.4.43 (June 2021), before TuxCare onboarded version 9.4.58.1. All..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:01:01.522418+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:01:01.522418+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:35:44.733301+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:35:44.733301+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.65.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-30T13:35:44.733301+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 9.4.65.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    }
  ]
}