{
  "@id": "urn:uuid:4a1e0ab8-12b4-49e1-b244-54890d1da362",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:57:45.485772+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:49:59.024011+00:00",
      "status_notes": "Vulnerability CVE-2023-44487 affects version 9.4.63.tuxcare0001 of org.eclipse.jetty.http2:http2-common.",
      "vulnerability": {
        "name": "CVE-2023-44487"
      },
      "action_statement": "Vulnerability CVE-2023-44487 affects version 9.4.63.tuxcare0001 of org.eclipse.jetty.http2:http2-common."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-22201 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.http2:http2-common. CVE-2024-22201 is not a vulnerability in version 9.4.63. The fix is already present in the code at jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/HTTP2Session.java lines 1888-1906, having been applied by upstream Eclipse Jetty in commit 86586df0a8a4d9c6b5af9a621ad1adf1b494d39b and first released in 9.4.54, from which 9.4.63 descends. The vulnerable pattern (returning false on the second idle timeout when the session is already closed, leaving TCP-congested connections in ESTABLISHED state until file descriptors are exhausted) has been removed: the already-closed branch of onIdleTimeout() now sets terminate = true and falls through to terminate(goAwayFrame), which closes the underlying connection. The HTTP/3 and QUIC code that the same upstream change also touched does not exist in the 9.4.x line.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22201"
      },
      "impact_statement": "CVE-2024-22201 is not a vulnerability in version 9.4.63. The fix is already present in the code at jetty-http2/http2-common/src/main/java/org/eclipse/jetty/http2/HTTP2Session.java lines 1888-1906, having been applied by upstream Eclipse Jetty in commit 86586df0a8a4d9c6b5af9a621ad1adf1b494d39b and first released in 9.4.54, from which 9.4.63 descends. The vulnerable pattern (returning false on the second idle timeout when the session is already closed, leaving TCP-congested connections in ESTABLISHED state until file descriptors are exhausted) has been removed: the already-closed branch of onIdleTimeout() now sets terminate = true and falls through to terminate(goAwayFrame), which closes the underlying connection. The HTTP/3 and QUIC code that the same upstream change also touched does not exist in the 9.4.x line."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-5115 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty.http2:http2-common. CVE-2025-5115 (MadeYouReset) is NOT present in Jetty 9.4.63. The vulnerability's rate-limiting fix was already included in the upstream Jetty 9.4.63 release (commit 2daf58d2560 by Simone Bordet, August 2025). All three mitigation components are present and functional: (1) rate control on server-sent RST_STREAM frames, (2) rate control on WINDOW_UPDATE frames received for closed streams, and (3) rate control on invalid WINDOW_UPDATE frames with delta=0. The rate limit is configured to 128 events/second.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-5115"
      },
      "impact_statement": "CVE-2025-5115 (MadeYouReset) is NOT present in Jetty 9.4.63. The vulnerability's rate-limiting fix was already included in the upstream Jetty 9.4.63 release (commit 2daf58d2560 by Simone Bordet, August 2025). All three mitigation components are present and functional: (1) rate control on server-sent RST_STREAM frames, (2) rate control on WINDOW_UPDATE frames received for closed streams, and (3) rate control on invalid WINDOW_UPDATE frames with delta=0. The rate limit is configured to 128 events/second."
    }
  ]
}