{
  "@id": "urn:uuid:8c0bfa39-794a-4b6d-bd5a-cee3b9b20f03",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:57:45.485772+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "action_statement": "Vulnerability CVE-2006-6969 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "action_statement": "Vulnerability CVE-2011-4461 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "action_statement": "Vulnerability CVE-2015-2080 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "action_statement": "Vulnerability CVE-2016-4800 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "action_statement": "Vulnerability CVE-2017-7656 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "action_statement": "Vulnerability CVE-2017-7658 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "action_statement": "Vulnerability CVE-2017-9735 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "action_statement": "Vulnerability CVE-2018-12536 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "action_statement": "Vulnerability CVE-2018-12545 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "action_statement": "Vulnerability CVE-2019-10241 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "action_statement": "Vulnerability CVE-2019-10246 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "action_statement": "Vulnerability CVE-2019-10247 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "action_statement": "Vulnerability CVE-2019-17632 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "action_statement": "Vulnerability CVE-2019-17638 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "action_statement": "Vulnerability CVE-2020-27218 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "action_statement": "Vulnerability CVE-2020-27223 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "action_statement": "Vulnerability CVE-2021-28165 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp. not_affected \u2014 The target repository (jetty-project 10.0.31) contains the upstream vendor fix for CVE-2021-34428. The vulnerability pattern has been removed by commit 087f486b446 authored by Jan Bartel from the Eclipse Jetty project. The fix ensures session IDs are invalidated even when SessionListener#sessionDestroyed() throws exceptions by moving the invalidateAll() call into a finally block. This is not a ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 The target repository (jetty-project 10.0.31) contains the upstream vendor fix for CVE-2021-34428. The vulnerability pattern has been removed by commit 087f486b446 authored by Jan Bartel from the Eclipse Jetty project. The fix ensures session IDs are invalidated even when SessionListener#sessionDestroyed() throws exceptions by moving the invalidateAll() call into a finally block. This is not a ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "action_statement": "Vulnerability CVE-2022-2047 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "action_statement": "Vulnerability CVE-2022-2191 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "action_statement": "Vulnerability CVE-2023-26048 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "action_statement": "Vulnerability CVE-2023-26049 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp. Version 10.0.28 is not vulnerable. Summary: The target repository has the fix for CVE-2023-40167 applied. The Content-Length parsing code in HttpParser.java uses strict digit-only validation that rejects '+' prefix, preventing HTTP request smuggling attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: The target repository has the fix for CVE-2023-40167 applied. The Content-Length parsing code in HttpParser.java uses strict digit-only validation that rejects '+' prefix, preventing HTTP request smuggling attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "action_statement": "Vulnerability CVE-2024-13009 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "impact_statement": "fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "action_statement": "Vulnerability CVE-2024-7708 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp. Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-8184. The security fix has already been applied to ThreadLimitHandler.java, implementing atomic operations with reference counting to prevent memory exhaustion. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 is fixed in version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp. not_affected \u2014 CVE-2026-10051 describes a trailer leak vulnerability in Jetty 12.x where connection-scoped _trailers field is never reset between HTTP/1.1 keep-alive requests. The target (Jetty 10.0.31) uses a different architecture where _trailers resides in HttpChannelOverHttp and is properly reset via recycle() method, which is called between every request. This defensive code has been present since traile...",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-10051 describes a trailer leak vulnerability in Jetty 12.x where connection-scoped _trailers field is never reset between HTTP/1.1 keep-alive requests. The target (Jetty 10.0.31) uses a different architecture where _trailers resides in HttpChannelOverHttp and is properly reset via recycle() method, which is called between every request. This defensive code has been present since traile..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp. Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 10.0.28 is not vulnerable. Summary: Target repository runs Jetty 10.0.28 which uses a fundamentally different architecture than the vulnerable Jetty 12.x versions. The cleanup mechanism for decompression resources is tied to the request lifecycle (Request.recycle) rather than the response lifecycle, preventing the resource leak described in CVE-2026-1605. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-15T09:43:02.853292+00:00",
      "status_notes": "Vulnerability CVE-2026-18660 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2026-18660"
      },
      "action_statement": "Vulnerability CVE-2026-18660 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 is fixed in version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.demos/demo-proxy-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.demos:demo-proxy-webapp. not_affected \u2014 Jetty 10.0.31 is NOT affected by CVE-2026-8384. The vulnerability requires specific code in Jetty 12's refactored architecture where canonicalPath() gained semicolon stripping with broken slash tracking. Jetty 10's canonicalPath() lacks the vulnerable case ';': handler entirely (lines 928-1010), treating semicolons as regular characters. The '/' after ';' correctly sets slash=true, enabling pro...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 Jetty 10.0.31 is NOT affected by CVE-2026-8384. The vulnerability requires specific code in Jetty 12's refactored architecture where canonicalPath() gained semicolon stripping with broken slash tracking. Jetty 10's canonicalPath() lacks the vulnerable case ';': handler entirely (lines 928-1010), treating semicolons as regular characters. The '/' after ';' correctly sets slash=true, enabling pro..."
    }
  ]
}