{
  "@id": "urn:uuid:898b3f34-3601-40bb-8ed0-cf1b5325a7a9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T15:51:12.144200+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-webapp@11.0.29.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-webapp@11.0.29.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T14:47:46.169120+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 11.0.29.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-webapp. not_affected \u2014 CVE-2022-2047: Target version 11.0.29 is NOT AFFECTED. The upstream vendor fix for incorrect URI authority parsing (issue #8014) was already present in release 11.0.26, which TuxCare onboarded as the starting point for this ELS branch. The fix commits (d1e64f469362bb9 and 4ca8afbbd667c1) are both ancestors of HEAD and ancestors of the first TuxCare commit (5559228a370 \"setup 11.0.26\"), confirmi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2047: Target version 11.0.29 is NOT AFFECTED. The upstream vendor fix for incorrect URI authority parsing (issue #8014) was already present in release 11.0.26, which TuxCare onboarded as the starting point for this ELS branch. The fix commits (d1e64f469362bb9 and 4ca8afbbd667c1) are both ancestors of HEAD and ancestors of the first TuxCare commit (5559228a370 \"setup 11.0.26\"), confirmi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-webapp@11.0.29.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-webapp@11.0.29.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-31T15:51:12.144200+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 does not affect version 11.0.29.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-webapp. not_affected \u2014 Target Jetty 11.0.29 is NOT AFFECTED by CVE-2023-40167. The upstream fix (commit e4d596eafc8) that replaces permissive Long.parseLong() with strict digit-only validation for Content-Length headers was already present in Jetty 11.0.26 and is included in the target version 11.0.29. The vulnerable pattern (accepting '+' or '-' prefixed Content-Length values) does not exist in the target codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 11.0.29 is NOT AFFECTED by CVE-2023-40167. The upstream fix (commit e4d596eafc8) that replaces permissive Long.parseLong() with strict digit-only validation for Content-Length headers was already present in Jetty 11.0.26 and is included in the target version 11.0.29. The vulnerable pattern (accepting '+' or '-' prefixed Content-Length values) does not exist in the target codebase."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-webapp@11.0.29.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-webapp@11.0.29.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 does not affect version 11.0.29.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-webapp. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "impact_statement": "fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-webapp@11.0.29.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-webapp@11.0.29.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 is fixed in version 11.0.29.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-webapp.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-webapp@11.0.29.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-webapp@11.0.29.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 is fixed in version 11.0.29.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-webapp.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-webapp@11.0.29.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-async-rest-webapp@11.0.29.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 11.0.29.tuxcare0001 of org.eclipse.jetty.demos:demo-async-rest-webapp. not_affected \u2014 Jetty 11.0.29 uses a fundamentally different architecture from the vulnerable Jetty 12.x code. The CVE describes a bug in Jetty 12's single-pass canonicalPath() method that performs both parameter stripping and path normalization inline. Jetty 11 uses a two-pass architecture where decodePath() strips semicolon parameters first, then canonicalPath() normalizes the result separately. This archite...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.29 uses a fundamentally different architecture from the vulnerable Jetty 12.x code. The CVE describes a bug in Jetty 12's single-pass canonicalPath() method that performs both parameter stripping and path normalization inline. Jetty 11 uses a two-pass architecture where decodePath() strips semicolon parameters first, then canonicalPath() normalizes the result separately. This archite..."
    }
  ]
}