{ "@id": "urn:uuid:ae7554cd-de3f-4d44-b319-745b31b5f1cb", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-30T19:05:00.113792+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2022-2047 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2022-2047" }, "action_statement": "Vulnerability CVE-2022-2047 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2023-40167 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2023-40167" }, "action_statement": "Vulnerability CVE-2023-40167 affects version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2024-6763 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-6763" }, "impact_statement": "fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable" }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2025-11143 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2025-11143" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2026-12611" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2026-18659 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2026-18659" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2026-18660 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2026-18660" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2026-18661 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2026-18661" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2026-18662 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2026-18662" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2026-19203" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2026-19204" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2026-19864 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2026-19864" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2026-2332 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2026-2332" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2026-76182" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2026-76184" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2026-77711" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:04:41.632189+00:00", "status_notes": "Vulnerability CVE-2026-8384 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar. not_affected \u2014 Jetty 11.0.30.tuxcare0002 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12's unified canonicalPath() method where slash state tracking gets corrupted when processing semicolon path parameters. Jetty 11 uses a different two-stage architecture that separates semicolon stripping (decodePath) from dot normalization (canonicalPath), preventing the vulnerable pattern from manife...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-8384" }, "impact_statement": "not_affected \u2014 Jetty 11.0.30.tuxcare0002 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12's unified canonicalPath() method where slash state tracking gets corrupted when processing semicolon path parameters. Jetty 11 uses a different two-stage architecture that separates semicolon stripping (decodePath) from dot normalization (canonicalPath), preventing the vulnerable pattern from manife..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-jar@11.0.34.tuxcare0001" } } ], "timestamp": "2026-10-30T19:05:00.113792+00:00", "status_notes": "Vulnerability CVE-2026-95533 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-jar.", "vulnerability": { "name": "CVE-2026-95533" } } ] }