{
  "@id": "urn:uuid:e8048639-f678-4bc2-9c98-3aff86b5ad33",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 20,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T17:58:34.238857+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "action_statement": "Vulnerability CVE-2006-6969 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:41:42.084809+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "action_statement": "Vulnerability CVE-2011-4461 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "action_statement": "Vulnerability CVE-2015-2080 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "action_statement": "Vulnerability CVE-2016-4800 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "action_statement": "Vulnerability CVE-2017-7656 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "action_statement": "Vulnerability CVE-2017-7658 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "action_statement": "Vulnerability CVE-2017-9735 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T17:58:34.238857+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot. not_affected \u2014 CVE-2018-12536 affects Eclipse Jetty Server (all 9.x versions) where malformed HTTP requests with bad path characters trigger InvalidPathException that reveals the full filesystem path in error responses. The target repository (Jetty 10.0.26-tuxcare.3) is NOT AFFECTED because the upstream vendor fix (commit ad4dceb1c08 from May 2018) was already present in the upstream Jetty 10.0.26 release tha...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 affects Eclipse Jetty Server (all 9.x versions) where malformed HTTP requests with bad path characters trigger InvalidPathException that reveals the full filesystem path in error responses. The target repository (Jetty 10.0.26-tuxcare.3) is NOT AFFECTED because the upstream vendor fix (commit ad4dceb1c08 from May 2018) was already present in the upstream Jetty 10.0.26 release tha..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "action_statement": "Vulnerability CVE-2018-12545 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T15:59:00.074224+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot. not_affected \u2014 CVE-2019-10241 is not present in Jetty 10.0.26. The upstream fix (commit 1565b5f160e) was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded. The fix adds proper URL decoding and HTML encoding to directory listings via the getFileName() method, hrefEncodeURI(), and deTag() functions, preventing XSS attacks through specially formatted filenames. The vulnerable pattern ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 is not present in Jetty 10.0.26. The upstream fix (commit 1565b5f160e) was already included in the upstream Jetty 10.0.26 release that TuxCare onboarded. The fix adds proper URL decoding and HTML encoding to directory listings via the getFileName() method, hrefEncodeURI(), and deTag() functions, preventing XSS attacks through specially formatted filenames. The vulnerable pattern ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "action_statement": "Vulnerability CVE-2019-10246 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T16:23:05.653968+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot. not_affected \u2014 Target version 10.0.26 is not affected by CVE-2019-10247. The vulnerability (information disclosure of fully qualified directory base resource locations in 404 error pages) was fixed in upstream Jetty before version 10.0.26 was released. The vulnerable code pattern (calls to context.toString() that exposed base resource paths) is not present in the current DefaultHandler implementation. The fix...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 Target version 10.0.26 is not affected by CVE-2019-10247. The vulnerability (information disclosure of fully qualified directory base resource locations in 404 error pages) was fixed in upstream Jetty before version 10.0.26 was released. The vulnerable code pattern (calls to context.toString() that exposed base resource paths) is not present in the current DefaultHandler implementation. The fix..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "action_statement": "Vulnerability CVE-2019-17632 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "action_statement": "Vulnerability CVE-2019-17638 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "action_statement": "Vulnerability CVE-2020-27216 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "action_statement": "Vulnerability CVE-2020-27218 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "action_statement": "Vulnerability CVE-2020-27223 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:49:59.024011+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "action_statement": "Vulnerability CVE-2021-28163 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "action_statement": "Vulnerability CVE-2021-28165 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "action_statement": "Vulnerability CVE-2021-34428 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "action_statement": "Vulnerability CVE-2021-34429 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T14:42:34.494037+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot. not_affected \u2014 CVE-2022-2047 affects Jetty's HttpURI class, which incorrectly parsed URIs like http://localhost;/path by treating 'localhost;' as the host. The target repository (Jetty 10.0.26) is NOT AFFECTED because the upstream fix (commit d1e64f469362bb9371d530cccded5ecb13fa1cb5) was already included in the Jetty 10.0.26 release that TuxCare onboarded. All defense mechanisms are present: (1) isPathValidFo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2047 affects Jetty's HttpURI class, which incorrectly parsed URIs like http://localhost;/path by treating 'localhost;' as the host. The target repository (Jetty 10.0.26) is NOT AFFECTED because the upstream fix (commit d1e64f469362bb9371d530cccded5ecb13fa1cb5) was already included in the Jetty 10.0.26 release that TuxCare onboarded. All defense mechanisms are present: (1) isPathValidFo..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "action_statement": "Vulnerability CVE-2022-2191 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T15:33:58.899667+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot. not_affected \u2014 The target repository (Jetty 10.0.26) is NOT affected by CVE-2023-26048. The vulnerability fix was already present in the upstream Jetty 10.0.26 release before TuxCare began maintaining this version. Both defenses from the upstream patch are present: (1) limit on number of multipart parts (_maxParts with default 1000), and (2) limit on cumulative size of parts without filenames (maxFormContentS...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 10.0.26) is NOT affected by CVE-2023-26048. The vulnerability fix was already present in the upstream Jetty 10.0.26 release before TuxCare began maintaining this version. Both defenses from the upstream patch are present: (1) limit on number of multipart parts (_maxParts with default 1000), and (2) limit on cumulative size of parts without filenames (maxFormContentS..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "action_statement": "Vulnerability CVE-2023-26049 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 does not affect version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot. not_affected \u2014 Target version 10.0.26 is NOT vulnerable to CVE-2023-40167. The upstream vendor (Eclipse Jetty) applied the fix in commit 003e46cae4d7 (2023-08-18) which replaced the permissive Long.parseLong() with strict character-by-character validation rejecting any non-digit characters including '+' prefix. This fix was already present in the upstream Jetty 10.0.26 release before TuxCare initialized their...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "impact_statement": "not_affected \u2014 Target version 10.0.26 is NOT vulnerable to CVE-2023-40167. The upstream vendor (Eclipse Jetty) applied the fix in commit 003e46cae4d7 (2023-08-18) which replaced the permissive Long.parseLong() with strict character-by-character validation rejecting any non-digit characters including '+' prefix. This fix was already present in the upstream Jetty 10.0.26 release before TuxCare initialized their..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "action_statement": "Vulnerability CVE-2024-13009 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "action_statement": "Vulnerability CVE-2024-6763 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "action_statement": "Vulnerability CVE-2024-7708 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "action_statement": "Vulnerability CVE-2024-8184 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      },
      "action_statement": "Vulnerability CVE-2025-11143 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10050 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2026-10050"
      },
      "action_statement": "Vulnerability CVE-2026-10050 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "action_statement": "Vulnerability CVE-2026-10051 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "action_statement": "Vulnerability CVE-2026-1605 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T09:59:09.094507+00:00",
      "status_notes": "Vulnerability CVE-2026-18659 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2026-18659"
      },
      "action_statement": "Vulnerability CVE-2026-18659 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T09:43:02.853292+00:00",
      "status_notes": "Vulnerability CVE-2026-18661 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2026-18661"
      },
      "action_statement": "Vulnerability CVE-2026-18661 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T09:59:09.094507+00:00",
      "status_notes": "Vulnerability CVE-2026-18662 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2026-18662"
      },
      "action_statement": "Vulnerability CVE-2026-18662 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T09:59:09.094507+00:00",
      "status_notes": "Vulnerability CVE-2026-19864 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2026-19864"
      },
      "action_statement": "Vulnerability CVE-2026-19864 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      },
      "action_statement": "Vulnerability CVE-2026-2332 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot, and is fixed in 10.0.26-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "action_statement": "Vulnerability CVE-2026-6790 affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot, and is fixed in 10.0.26-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot. not_affected \u2014 Jetty 10.0.26-tuxcare.1 is NOT affected by CVE-2026-8384. The vulnerability requires Jetty 12's specific architecture where encoded path processing and dot-segment normalization occur in a single method with slash-state tracking. Jetty 10 uses a two-step architecture (decodePath then canonicalPath) without slash-state tracking, preventing the vulnerability chain from forming.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 Jetty 10.0.26-tuxcare.1 is NOT affected by CVE-2026-8384. The vulnerability requires Jetty 12's specific architecture where encoded path processing and dot-segment normalization occur in a single method with slash-state tracking. Jetty 10 uses a two-step architecture (decodePath then canonicalPath) without slash-state tracking, preventing the vulnerability chain from forming."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.osgi/jetty-osgi-boot@10.0.26-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot.",
      "vulnerability": {
        "name": "GHSA-58qw-p7qm-5rvh"
      },
      "action_statement": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 10.0.26-tuxcare.1 of org.eclipse.jetty.osgi:jetty-osgi-boot."
    }
  ]
}