{
  "@id": "urn:uuid:3b3d3745-ed4c-4bb2-8abb-acd0b09a7b48",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:57:45.485772+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.http3/http3-qpack@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.http3/http3-qpack@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-36478 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty.http3:http3-qpack. CVE-2023-36478 is not present in Jetty 10.0.31. The vulnerable integer overflow in MetaDataBuilder.checkSize was removed from the 10.0.x line by the HPACK/QPACK rework of Jetty issue 9554 (pull request 9634), first shipped in Jetty 10.0.16; the method no longer exists in jetty-http2/http2-hpack, and MetaDataBuilder.emit accounts header size as name plus value length with no multiplication. String literal lengths are decoded by NBitIntegerDecoder using Math.addExact, Math.multiplyExact and Math.toIntExact, so an oversized encoded length throws rather than wrapping negative. HuffmanDecoder builds its output into a dynamically grown Iso88591StringBuilder and never preallocates from the declared length, and HpackDecoder.decode rejects a header block larger than the configured maximum before decoding begins. The large buffer allocation the advisory describes therefore cannot occur.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-36478"
      },
      "impact_statement": "CVE-2023-36478 is not present in Jetty 10.0.31. The vulnerable integer overflow in MetaDataBuilder.checkSize was removed from the 10.0.x line by the HPACK/QPACK rework of Jetty issue 9554 (pull request 9634), first shipped in Jetty 10.0.16; the method no longer exists in jetty-http2/http2-hpack, and MetaDataBuilder.emit accounts header size as name plus value length with no multiplication. String literal lengths are decoded by NBitIntegerDecoder using Math.addExact, Math.multiplyExact and Math.toIntExact, so an oversized encoded length throws rather than wrapping negative. HuffmanDecoder builds its output into a dynamically grown Iso88591StringBuilder and never preallocates from the declared length, and HpackDecoder.decode rejects a header block larger than the configured maximum before decoding begins. The large buffer allocation the advisory describes therefore cannot occur."
    }
  ]
}