{
  "@id": "urn:uuid:0da11277-641f-4c59-a879-a516c79b0a91",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 23,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T18:02:30.639285+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "action_statement": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "action_statement": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:41:42.084809+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "action_statement": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "action_statement": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "action_statement": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "action_statement": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "action_statement": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "action_statement": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T18:02:30.639285+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp. not_affected \u2014 CVE-2018-12536 is not present in Jetty 12.0.22-tuxcare.1. The vulnerability (path disclosure through InvalidPathException) was fixed in upstream Jetty before version 12.0.22 was released. The fix wraps all exceptions in ResourceHttpContentFactory.getContent() to sanitize error messages, preventing full filesystem paths from being leaked. The fix commit (abc40afd890) by upstream author lachlan@w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 is not present in Jetty 12.0.22-tuxcare.1. The vulnerability (path disclosure through InvalidPathException) was fixed in upstream Jetty before version 12.0.22 was released. The fix wraps all exceptions in ResourceHttpContentFactory.getContent() to sanitize error messages, preventing full filesystem paths from being leaked. The fix commit (abc40afd890) by upstream author lachlan@w..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "action_statement": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T16:03:05.849088+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp. not_affected \u2014 CVE-2019-10241 affects Eclipse Jetty's directory listing functionality where specially formatted URLs could trigger XSS. The vulnerability existed when full resource paths (which could contain malicious content) were used directly in HTML output. The upstream fix introduced a `getFileName()` method to extract only the filename portion. Target version 12.0.22-tuxcare.1 contains the upstream fix ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 affects Eclipse Jetty's directory listing functionality where specially formatted URLs could trigger XSS. The vulnerability existed when full resource paths (which could contain malicious content) were used directly in HTML output. The upstream fix introduced a `getFileName()` method to extract only the filename portion. Target version 12.0.22-tuxcare.1 contains the upstream fix ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "action_statement": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T16:27:26.409965+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp. not_affected \u2014 CVE-2019-10247 is not present in Jetty 12.0.22-tuxcare.1. The vulnerability involved DefaultHandler revealing filesystem base resource paths in 404 error responses via context.toString(). The upstream fix (commit 04c994712c0) removed this disclosure and was applied in 2019. Jetty 12.0.22, released years later, already contained the fix when TuxCare onboarded it. The vulnerable code pattern is c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 is not present in Jetty 12.0.22-tuxcare.1. The vulnerability involved DefaultHandler revealing filesystem base resource paths in 404 error responses via context.toString(). The upstream fix (commit 04c994712c0) removed this disclosure and was applied in 2019. Jetty 12.0.22, released years later, already contained the fix when TuxCare onboarded it. The vulnerable code pattern is c..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "action_statement": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "action_statement": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "action_statement": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "action_statement": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "action_statement": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T15:22:00.101796+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp. not_affected \u2014 CVE-2021-34428 is NOT present in Jetty 12.0.22-tuxcare.1. The vulnerability concerned session ID invalidation failure when SessionListener#sessionDestroyed() throws an exception. The target code contains the upstream fix: session listener calls are wrapped in try-catch (ManagedSession.java:638-646), and session ID manager invalidation is executed in a finally block (lines 647-654), ensuring inv...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34428 is NOT present in Jetty 12.0.22-tuxcare.1. The vulnerability concerned session ID invalidation failure when SessionListener#sessionDestroyed() throws an exception. The target code contains the upstream fix: session listener calls are wrapped in try-catch (ManagedSession.java:638-646), and session ID manager invalidation is executed in a finally block (lines 647-654), ensuring inv..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T14:47:00.095922+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp. not_affected \u2014 CVE-2022-2047 affects Jetty's HttpURI class parsing of malformed URIs like `http://localhost;/path`. The target is Jetty 12.0.22-tuxcare.1, a major version released after the vulnerability was fixed. The fix (isPathValidForAuthority validation) was already present in upstream Jetty 12.0.0 (released 2023-08-07), over a year after the CVE was patched in Jetty 9/10/11 (2022-05-26). The vulnerable ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2047 affects Jetty's HttpURI class parsing of malformed URIs like `http://localhost;/path`. The target is Jetty 12.0.22-tuxcare.1, a major version released after the vulnerability was fixed. The fix (isPathValidForAuthority validation) was already present in upstream Jetty 12.0.0 (released 2023-08-07), over a year after the CVE was patched in Jetty 9/10/11 (2022-05-26). The vulnerable ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "action_statement": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "action_statement": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T15:07:00.117911+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp. not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values with semicolons) is NOT present in Jetty 12.0.22. The upstream fix (commit 7b8c2c1bf081c7f4) was already included in the upstream Jetty 12.0.22 release before TuxCare onboarded it. The default RFC6265CookieParser properly terminates quoted cookie values and rejects semicolons inside quotes as INVALID_COOKIES. The deprecated CookieCutter legacy ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values with semicolons) is NOT present in Jetty 12.0.22. The upstream fix (commit 7b8c2c1bf081c7f4) was already included in the upstream Jetty 12.0.22 release before TuxCare onboarded it. The default RFC6265CookieParser properly terminates quoted cookie values and rejects semicolons inside quotes as INVALID_COOKIES. The deprecated CookieCutter legacy ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2023-36479 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2023-36479"
      },
      "action_statement": "Vulnerability CVE-2023-36479 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T15:50:00.104086+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp. not_affected \u2014 CVE-2023-40167 is NOT AFFECTED in Jetty 12.0.22. The vulnerability (accepting '+' prefix in Content-Length header values, leading to potential HTTP request smuggling) was fixed in the upstream Jetty codebase on 2023-08-18 by Greg Wilkins in commit 003e46cae4d7. This fix replaced Long.parseLong() with character-by-character validation that strictly enforces RFC 9110 Section 8.6 (only '0'-'9' dig...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-40167 is NOT AFFECTED in Jetty 12.0.22. The vulnerability (accepting '+' prefix in Content-Length header values, leading to potential HTTP request smuggling) was fixed in the upstream Jetty codebase on 2023-08-18 by Greg Wilkins in commit 003e46cae4d7. This fix replaced Long.parseLong() with character-by-character validation that strictly enforces RFC 9110 Section 8.6 (only '0'-'9' dig..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "action_statement": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T15:27:00.073475+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp. not_affected \u2014 CVE-2024-6763 fix is already present in jetty 12.0.22. The upstream commit c880d9309b6 (authored by gregw@webtide.com) added comprehensive authority validation to HttpURI, including checks that reject malformed URIs with invalid characters in the authority section. This commit shipped in the upstream Jetty 12.0.22 release before TuxCare onboarded it (first TuxCare commit: 11545e1f96a). The vali...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-6763 fix is already present in jetty 12.0.22. The upstream commit c880d9309b6 (authored by gregw@webtide.com) added comprehensive authority validation to HttpURI, including checks that reject malformed URIs with invalid characters in the authority section. This commit shipped in the upstream Jetty 12.0.22 release before TuxCare onboarded it (first TuxCare commit: 11545e1f96a). The vali..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "action_statement": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "action_statement": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2024-9823 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2024-9823"
      },
      "action_statement": "Vulnerability CVE-2024-9823 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      },
      "action_statement": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:18:00.127363+00:00",
      "status_notes": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-10050"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "action_statement": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "action_statement": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-18659"
      },
      "action_statement": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-18660"
      },
      "action_statement": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-18661"
      },
      "action_statement": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-18662"
      },
      "action_statement": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-19864"
      },
      "action_statement": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:18:00.127363+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:18:00.127363+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.demos/jetty-ee8-demo-jetty-webapp@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "action_statement": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp."
    }
  ]
}