{
  "@id": "urn:uuid:78b04103-e8f7-4ca7-ae86-f9acce1c1d0d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T17:55:02.198999+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "action_statement": "Vulnerability CVE-2006-6969 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T23:41:42.084809+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "action_statement": "Vulnerability CVE-2011-4461 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "action_statement": "Vulnerability CVE-2015-2080 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "action_statement": "Vulnerability CVE-2016-4800 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "action_statement": "Vulnerability CVE-2017-7656 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "action_statement": "Vulnerability CVE-2017-7658 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "action_statement": "Vulnerability CVE-2017-9735 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T17:55:02.198999+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 The target repository (Jetty 9.4.50.v20221201) is NOT affected by CVE-2018-12536. The vulnerability, which allowed server file system paths to be disclosed in error responses when processing malformed HTTP requests, was fixed by upstream Jetty developers in May 2018 (commits 53e8bc2a636, 65de2c66901, ad4dceb1c08). This fix was already present in the 9.4.50.v20221201 release when TuxCare onboard...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 9.4.50.v20221201) is NOT affected by CVE-2018-12536. The vulnerability, which allowed server file system paths to be disclosed in error responses when processing malformed HTTP requests, was fixed by upstream Jetty developers in May 2018 (commits 53e8bc2a636, 65de2c66901, ad4dceb1c08). This fix was already present in the 9.4.50.v20221201 release when TuxCare onboard..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "action_statement": "Vulnerability CVE-2018-12545 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T15:57:00.514770+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 The target repository (Jetty 9.4.50.v20221201) is NOT vulnerable to CVE-2019-10241. The XSS vulnerability in directory listings was fixed in upstream commit 7b774d82e82 (April 2019) which was already included in the upstream release 9.4.50.v20221201 that TuxCare onboarded. The fix replaced the vulnerable pattern that used getName() and manual path parsing with a new getFileName() method that pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 9.4.50.v20221201) is NOT vulnerable to CVE-2019-10241. The XSS vulnerability in directory listings was fixed in upstream commit 7b774d82e82 (April 2019) which was already included in the upstream release 9.4.50.v20221201 that TuxCare onboarded. The fix replaced the vulnerable pattern that used getName() and manual path parsing with a new getFileName() method that pr..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "action_statement": "Vulnerability CVE-2019-10246 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T16:23:05.653968+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 CVE-2019-10247 is NOT present in Jetty 9.4.50.v20221201. The vulnerability (disclosure of base resource directory paths in 404 error pages) was fixed in upstream Jetty 9.4.17 (April 2019), over three years before version 9.4.50 (December 2022). The fix commits are present in HEAD's ancestry and the vulnerable code pattern (context.toString() output in DefaultHandler) is absent from the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 is NOT present in Jetty 9.4.50.v20221201. The vulnerability (disclosure of base resource directory paths in 404 error pages) was fixed in upstream Jetty 9.4.17 (April 2019), over three years before version 9.4.50 (December 2022). The fix commits are present in HEAD's ancestry and the vulnerable code pattern (context.toString() output in DefaultHandler) is absent from the target."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "action_statement": "Vulnerability CVE-2019-17632 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "action_statement": "Vulnerability CVE-2019-17638 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "action_statement": "Vulnerability CVE-2020-27218 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "action_statement": "Vulnerability CVE-2020-27223 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "action_statement": "Vulnerability CVE-2021-28165 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server. Version 9.4.50.v20221201 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "Version 9.4.50.v20221201 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T14:38:39.744053+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 CVE-2022-2047 is not present in the target repository. The upstream fix (commit 4ca8afbbd667c19a084d5ff14a4f08eb7049d1c7) was already included in Jetty version 9.4.50.v20221201, which TuxCare onboarded. The fix adds validation to prevent relative paths (e.g., paths starting with \";\") when an authority (host) is set, and properly parses CONNECT method URIs as authority-only. All defensive code f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2047 is not present in the target repository. The upstream fix (commit 4ca8afbbd667c19a084d5ff14a4f08eb7049d1c7) was already included in Jetty version 9.4.50.v20221201, which TuxCare onboarded. The fix adds validation to prevent relative paths (e.g., paths starting with \";\") when an authority (host) is set, and properly parses CONNECT method URIs as authority-only. All defensive code f..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "action_statement": "Vulnerability CVE-2022-2191 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2023-26048"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2023-26049"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2023-40167"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2024-13009"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server, and is fixed in 9.4.50.v20221201-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "action_statement": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server, and is fixed in 9.4.50.v20221201-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "action_statement": "Vulnerability CVE-2024-7708 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2024-8184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-10051. While the CVE describes a cross-request trailer leakage vulnerability in Jetty 12+, this target version uses a different architecture where the fix has been present since July 2017 (commit be1eb26670f). The _trailers field is properly cleared in HttpChannel.recycle() (line 418) and HttpChannelOverHttp.recycle() (line 89), which are calle..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server. Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 9.4.50.v20221201 is not vulnerable. Summary: Target repository is Jetty 9.4.50.v20221201, which predates the vulnerable Jetty 12.x architecture. CVE-2026-1605 specifically affects Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 with their new Content API and GzipRequest implementation. The target uses a completely different architecture for gzip request handling. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-15T09:43:02.853292+00:00",
      "status_notes": "Vulnerability CVE-2026-18660 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2026-18660"
      },
      "action_statement": "Vulnerability CVE-2026-18660 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      },
      "action_statement": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "action_statement": "Vulnerability CVE-2026-6790 affects version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.fcgi/fcgi-server@9.4.50.v20221201-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.4 of org.eclipse.jetty.fcgi:fcgi-server. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class."
    }
  ]
}