{
  "@id": "urn:uuid:9528174e-1219-4040-93d1-1f6491b1dec4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:57:45.485772+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:49:59.024011+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "action_statement": "Vulnerability CVE-2023-44487 affects version 10.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-common."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-common. CVE-2024-22201 is not present in target Jetty 10.0.31. The vulnerability (HTTP/2 idle timeout failure to close TCP-congested connections) was fixed by upstream vendor in commit b953871c9a5ff4fbca4a2499848f75182dbd9810, included in Jetty 10.0.20 release (January 2024). Target version 10.0.31 contains this fix. The vulnerable code pattern (early return without calling terminate()) has been replaced with logic that force-terminates the connection even when the session is marked closed, preventing file descriptor exhaustion.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "impact_statement": "CVE-2024-22201 is not present in target Jetty 10.0.31. The vulnerability (HTTP/2 idle timeout failure to close TCP-congested connections) was fixed by upstream vendor in commit b953871c9a5ff4fbca4a2499848f75182dbd9810, included in Jetty 10.0.20 release (January 2024). Target version 10.0.31 contains this fix. The vulnerable code pattern (early return without calling terminate()) has been replaced with logic that force-terminates the connection even when the session is marked closed, preventing file descriptor exhaustion."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.http2:http2-common. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-5115"
      },
      "impact_statement": "fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable"
    }
  ]
}