{
  "@id": "urn:uuid:49f2b847-9d0d-4f61-8830-9b00a7e4ef75",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 25,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T18:00:07.490522+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "action_statement": "Vulnerability CVE-2006-6969 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:41:42.084809+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "action_statement": "Vulnerability CVE-2011-4461 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "action_statement": "Vulnerability CVE-2015-2080 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "action_statement": "Vulnerability CVE-2016-4800 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "action_statement": "Vulnerability CVE-2017-7656 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "action_statement": "Vulnerability CVE-2017-7658 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "action_statement": "Vulnerability CVE-2017-9735 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T18:00:07.490522+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 CVE-2018-12536 is NOT present in Jetty 11.0.26. The vulnerability allowed attackers to discover server file system paths through InvalidPathException messages when sending HTTP requests with malformed characters (e.g., control characters like %0a). The upstream fix by Joakim Erdfelt (commits 53e8bc2a636 and ad4dceb1c08) sanitizes all exceptions during resource loading to only expose the user-su...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 is NOT present in Jetty 11.0.26. The vulnerability allowed attackers to discover server file system paths through InvalidPathException messages when sending HTTP requests with malformed characters (e.g., control characters like %0a). The upstream fix by Joakim Erdfelt (commits 53e8bc2a636 and ad4dceb1c08) sanitizes all exceptions during resource loading to only expose the user-su..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "action_statement": "Vulnerability CVE-2018-12545 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T16:01:18.810144+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 CVE-2019-10241 does not affect this target. The vulnerability (XSS in directory listings via percent-encoded special characters bypassing HTML escaping) was fixed in upstream Jetty commit 1565b5f160e (April 2019, issue #3549) by adding proper URL-decoding before HTML escaping. This fix was already present in the upstream Jetty 11.0.26 release that TuxCare onboarded. The defensive code is confir...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 does not affect this target. The vulnerability (XSS in directory listings via percent-encoded special characters bypassing HTML escaping) was fixed in upstream Jetty commit 1565b5f160e (April 2019, issue #3549) by adding proper URL-decoding before HTML escaping. This fix was already present in the upstream Jetty 11.0.26 release that TuxCare onboarded. The defensive code is confir..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "action_statement": "Vulnerability CVE-2019-10246 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T16:24:35.622872+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 CVE-2019-10247 affects Jetty versions 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older. The target version 11.0.26 is not vulnerable. The vulnerable code pattern (outputting context.toString() in the DefaultHandler's 404 error response, which revealed filesystem base resource paths) is not present in the target. The fix was shipped in the upstream Jetty release before TuxCare ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 affects Jetty versions 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older. The target version 11.0.26 is not vulnerable. The vulnerable code pattern (outputting context.toString() in the DefaultHandler's 404 error response, which revealed filesystem base resource paths) is not present in the target. The fix was shipped in the upstream Jetty release before TuxCare ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "action_statement": "Vulnerability CVE-2019-17632 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "action_statement": "Vulnerability CVE-2019-17638 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "action_statement": "Vulnerability CVE-2020-27218 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "action_statement": "Vulnerability CVE-2020-27223 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "action_statement": "Vulnerability CVE-2021-28165 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:17:00.108725+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 The target repository (Eclipse Jetty 11.0.26-tuxcare.3) is NOT AFFECTED by CVE-2021-34428. The vulnerability fix was already present in the upstream release 11.0.26 before TuxCare onboarded it. The fix (commit 087f486b4461746b4ded45833887b3ccb136ee85 by upstream developer janb@webtide.com) ensures session ID invalidation completes even when SessionListener#sessionDestroyed() throws exceptions, ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 The target repository (Eclipse Jetty 11.0.26-tuxcare.3) is NOT AFFECTED by CVE-2021-34428. The vulnerability fix was already present in the upstream release 11.0.26 before TuxCare onboarded it. The fix (commit 087f486b4461746b4ded45833887b3ccb136ee85 by upstream developer janb@webtide.com) ensures session ID invalidation completes even when SessionListener#sessionDestroyed() throws exceptions, ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T14:42:00.201493+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 CVE-2022-2047 is NOT present in target version 11.0.26. The vulnerability involved HttpURI parsing invalid URIs with relative paths when authority is present (e.g., `http://localhost;/path`), enabling request misdirection. The upstream fix (commit d1e64f469362bb9371d530cccded5ecb13fa1cb5, authored by Simone Bordet) was already included in Jetty 11.0.10 and is present in this 11.0.26 release. Th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2047 is NOT present in target version 11.0.26. The vulnerability involved HttpURI parsing invalid URIs with relative paths when authority is present (e.g., `http://localhost;/path`), enabling request misdirection. The upstream fix (commit d1e64f469362bb9371d530cccded5ecb13fa1cb5, authored by Simone Bordet) was already included in Jetty 11.0.10 and is present in this 11.0.26 release. Th..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "action_statement": "Vulnerability CVE-2022-2191 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:36:43.900585+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 CVE-2023-26048 is NOT present in Jetty 11.0.26-tuxcare.3. The vulnerability allowed attackers to cause OutOfMemoryError via multipart requests with either (a) excessive number of parts or (b) parts without filename containing very large content. The fix (limiting part count and tracking cumulative size of non-file parts) was introduced in upstream Jetty by commit a5344d7a2609 on Feb 9, 2023, an...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26048 is NOT present in Jetty 11.0.26-tuxcare.3. The vulnerability allowed attackers to cause OutOfMemoryError via multipart requests with either (a) excessive number of parts or (b) parts without filename containing very large content. The fix (limiting part count and tracking cumulative size of non-file parts) was introduced in upstream Jetty by commit a5344d7a2609 on Feb 9, 2023, an..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:04:00.095012+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 The target repository (Jetty 11.0.26-tuxcare.3) is NOT vulnerable to CVE-2023-26049. The vulnerability (cookie smuggling via semicolons in quoted cookie values) was fixed in upstream Jetty 11.0.15 via commits 7b8c2c1bf08 and 1be1401bafb (February 2023). The fix introduced RFC6265CookieParser which properly rejects cookies containing semicolons inside quoted values. Version 11.0.26 inherits this...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.26-tuxcare.3) is NOT vulnerable to CVE-2023-26049. The vulnerability (cookie smuggling via semicolons in quoted cookie values) was fixed in upstream Jetty 11.0.15 via commits 7b8c2c1bf08 and 1be1401bafb (February 2023). The fix introduced RFC6265CookieParser which properly rejects cookies containing semicolons inside quoted values. Version 11.0.26 inherits this..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:48:24.061171+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 CVE-2023-40167: The target (Jetty 11.0.26-tuxcare.3) is not affected. The vulnerability was an HTTP request smuggling issue where Jetty accepted '+' prefix in Content-Length header values (e.g., \"Content-Length: +16\"), which could lead to parser disagreement with other HTTP servers. The upstream fix commit e4d596eafc887bcd813ae6e28295b5ce327def47 by Joakim Erdfelt replaced Long.parseLong() with...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-40167: The target (Jetty 11.0.26-tuxcare.3) is not affected. The vulnerability was an HTTP request smuggling issue where Jetty accepted '+' prefix in Content-Length header values (e.g., \"Content-Length: +16\"), which could lead to parser disagreement with other HTTP servers. The upstream fix commit e4d596eafc887bcd813ae6e28295b5ce327def47 by Joakim Erdfelt replaced Long.parseLong() with..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "action_statement": "Vulnerability CVE-2024-13009 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 is fixed in version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2024-6763"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "action_statement": "Vulnerability CVE-2024-7708 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 CVE-2024-8184 does not affect this target. The vulnerable pattern (unbounded growth of the _remotes ConcurrentHashMap in ThreadLimitHandler) is absent because upstream Eclipse Jetty already fixed it in version 11.0.24 (commit d1a9ca11563 by Ludovic Orban, Aug 2024). The target is based on Jetty 11.0.26, which inherits the fix from upstream. The current code contains reference counting (Referenc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-8184 does not affect this target. The vulnerable pattern (unbounded growth of the _remotes ConcurrentHashMap in ThreadLimitHandler) is absent because upstream Eclipse Jetty already fixed it in version 11.0.24 (commit d1a9ca11563 by Ludovic Orban, Aug 2024). The target is based on Jetty 11.0.26, which inherits the fix from upstream. The current code contains reference counting (Referenc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server. All 1 patch commits already exist in target branch",
      "vulnerability": {
        "name": "CVE-2025-11143"
      },
      "impact_statement": "All 1 patch commits already exist in target branch"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "action_statement": "Vulnerability CVE-2026-10051 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server. Jetty 11.0.26 is outside the affected range (12.0.0\u201312.0.31 and 12.1.0\u201312.1.5). CVE-2026-1605 affects the Jetty 12 lifecycle where releasing the request Inflater depends on a response compression callback. This code path is absent in Jetty 11.0.26, where the gzip input interceptor is destroyed during request recycle regardless of response compression. Therefore, the vulnerable resource retention path does not exist in this version.",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Jetty 11.0.26 is outside the affected range (12.0.0\u201312.0.31 and 12.1.0\u201312.1.5). CVE-2026-1605 affects the Jetty 12 lifecycle where releasing the request Inflater depends on a response compression callback. This code path is absent in Jetty 11.0.26, where the gzip input interceptor is destroyed during request recycle regardless of response compression. Therefore, the vulnerable resource retention path does not exist in this version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T09:43:02.853292+00:00",
      "status_notes": "Vulnerability CVE-2026-18660 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2026-18660"
      },
      "action_statement": "Vulnerability CVE-2026-18660 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      },
      "action_statement": "Vulnerability CVE-2026-2332 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T21:23:22.979954+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server, and is fixed in 11.0.26-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "action_statement": "Vulnerability CVE-2026-6790 affects version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server, and is fixed in 11.0.26-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@11.0.26-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 11.0.26-tuxcare.2 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 Jetty 11.0.26 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12 where URIUtil.canonicalPath() integrates semicolon path parameter handling with dot-segment normalization and contains a slash state tracking bug. Jetty 11 uses a different architecture with separate decodePath() and canonicalPath() methods that correctly normalize paths containing semicolons.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.26 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12 where URIUtil.canonicalPath() integrates semicolon path parameter handling with dot-segment normalization and contains a slash state tracking bug. Jetty 11 uses a different architecture with separate decodePath() and canonicalPath() methods that correctly normalize paths containing semicolons."
    }
  ]
}