{
  "@id": "urn:uuid:9e09f231-2667-4c4f-a5ca-210e72c7d009",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T14:36:43.933701+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-31T14:36:43.933701+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.http2:http2-hpack. not_affected \u2014 CVE-2022-2047 is NOT present in target version 9.4.58.v20250814. The upstream fix (commit 4ca8afbbd667c19a084d5ff14a4f08eb7049d1c7 by Simone Bordet) was already included in the upstream Jetty release that TuxCare onboarded. The fix adds validation in HttpURI.setAuthority(), setPath(), and setPathQuery() to reject relative paths (not starting with \"/\") when an authority is present, preventing mi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2047 is NOT present in target version 9.4.58.v20250814. The upstream fix (commit 4ca8afbbd667c19a084d5ff14a4f08eb7049d1c7 by Simone Bordet) was already included in the upstream Jetty release that TuxCare onboarded. The fix adds validation in HttpURI.setAuthority(), setPath(), and setPathQuery() to reject relative paths (not starting with \"/\") when an authority is present, preventing mi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-36478 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.http2:http2-hpack.",
      "vulnerability": {
        "name": "CVE-2023-36478"
      },
      "action_statement": "Vulnerability CVE-2023-36478 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.http2:http2-hpack."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.http2:http2-hpack.",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "action_statement": "Vulnerability CVE-2023-40167 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.http2:http2-hpack."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.http2:http2-hpack.",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "action_statement": "Vulnerability CVE-2024-6763 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.http2:http2-hpack."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.http2:http2-hpack.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      },
      "action_statement": "Vulnerability CVE-2025-11143 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.http2:http2-hpack."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.http2:http2-hpack.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      },
      "action_statement": "Vulnerability CVE-2026-2332 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.http2:http2-hpack."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http2/http2-hpack@9.4.58.v20250814-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.http2:http2-hpack. not_affected \u2014 Jetty 9.4.58.v20250814 is not affected by CVE-2026-8384. The vulnerability exists only in Jetty 12's refactored canonicalPath() implementation that combines path decoding and canonicalization with slash-state tracking. Jetty 9.4 uses a two-stage architecture (decodePath() followed by canonicalPath()) that correctly normalizes paths containing semicolon path parameters before dot-dot segments, p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 Jetty 9.4.58.v20250814 is not affected by CVE-2026-8384. The vulnerability exists only in Jetty 12's refactored canonicalPath() implementation that combines path decoding and canonicalization with slash-state tracking. Jetty 9.4 uses a two-stage architecture (decodePath() followed by canonicalPath()) that correctly normalizes paths containing semicolon path parameters before dot-dot segments, p..."
    }
  ]
}