{
  "@id": "urn:uuid:d4a78e17-9d71-4478-839b-895d8299438e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T14:38:39.744053+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.50.v20221201-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.50.v20221201-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T14:38:39.744053+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.http2:http2-hpack. not_affected \u2014 CVE-2022-2047 is not present in the target repository. The upstream fix (commit 4ca8afbbd667c19a084d5ff14a4f08eb7049d1c7) was already included in Jetty version 9.4.50.v20221201, which TuxCare onboarded. The fix adds validation to prevent relative paths (e.g., paths starting with \";\") when an authority (host) is set, and properly parses CONNECT method URIs as authority-only. All defensive code f...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2047 is not present in the target repository. The upstream fix (commit 4ca8afbbd667c19a084d5ff14a4f08eb7049d1c7) was already included in Jetty version 9.4.50.v20221201, which TuxCare onboarded. The fix adds validation to prevent relative paths (e.g., paths starting with \";\") when an authority (host) is set, and properly parses CONNECT method URIs as authority-only. All defensive code f..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.50.v20221201-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.50.v20221201-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.http2:http2-hpack.",
      "vulnerability": {
        "name": "CVE-2023-36478"
      },
      "action_statement": "Vulnerability CVE-2023-36478 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.http2:http2-hpack."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.50.v20221201-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.50.v20221201-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.http2:http2-hpack.",
      "vulnerability": {
        "name": "CVE-2023-40167"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.50.v20221201-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.50.v20221201-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.http2:http2-hpack, and is fixed in 9.4.50.v20221201-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "action_statement": "Vulnerability CVE-2024-6763 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.http2:http2-hpack, and is fixed in 9.4.50.v20221201-tuxcare.5."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.50.v20221201-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.50.v20221201-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 is fixed in version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.http2:http2-hpack.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.50.v20221201-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.50.v20221201-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.http2:http2-hpack.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      },
      "action_statement": "Vulnerability CVE-2026-2332 affects version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.http2:http2-hpack."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.50.v20221201-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.50.v20221201-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 9.4.50.v20221201-tuxcare.2 of org.eclipse.jetty.http2:http2-hpack. not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 Jetty 9.4.50.v20221201 is not affected by CVE-2026-8384. While Jetty 12.x contains a vulnerability in combined semicolon-handling and path-normalization logic (where stale state tracking after processing `;/` prevents dot-segment detection), Jetty 9.4.50 uses a fundamentally different two-step architecture that eliminates this vulnerability class."
    }
  ]
}