{ "@id": "urn:uuid:e7f442a2-5955-4231-8ab8-b55bf6bd7f3d", "role": "Document Creator", "author": "https://tuxcare.com", "version": 22, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-31T18:02:30.639285+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2006-6969 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2006-6969" }, "action_statement": "Vulnerability CVE-2006-6969 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-28T23:41:42.084809+00:00", "status_notes": "Vulnerability CVE-2011-4461 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2011-4461" }, "action_statement": "Vulnerability CVE-2011-4461 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2015-2080 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2015-2080" }, "action_statement": "Vulnerability CVE-2015-2080 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2016-4800 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2016-4800" }, "action_statement": "Vulnerability CVE-2016-4800 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2017-7656 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2017-7656" }, "action_statement": "Vulnerability CVE-2017-7656 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2017-7657 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2017-7657" }, "action_statement": "Vulnerability CVE-2017-7657 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-28T22:26:53.294923+00:00", "status_notes": "Vulnerability CVE-2017-7658 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2017-7658" }, "action_statement": "Vulnerability CVE-2017-7658 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2017-9735 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2017-9735" }, "action_statement": "Vulnerability CVE-2017-9735 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-31T18:02:30.639285+00:00", "status_notes": "Vulnerability CVE-2018-12536 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests. not_affected \u2014 CVE-2018-12536 is an information disclosure vulnerability where malformed HTTP request paths trigger InvalidPathException containing full server filesystem paths, which leak in error responses when handled by the default error handler. The upstream fix (commit ad4dceb1c08 authored by joakim.erdfelt@gmail.com on 2018-05-31) was already present in Jetty 9.4.51.v20230217 before TuxCare onboarded i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-12536" }, "impact_statement": "not_affected \u2014 CVE-2018-12536 is an information disclosure vulnerability where malformed HTTP request paths trigger InvalidPathException containing full server filesystem paths, which leak in error responses when handled by the default error handler. The upstream fix (commit ad4dceb1c08 authored by joakim.erdfelt@gmail.com on 2018-05-31) was already present in Jetty 9.4.51.v20230217 before TuxCare onboarded i..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2018-12538" }, "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2018-12545 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2018-12545" }, "action_statement": "Vulnerability CVE-2018-12545 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-31T16:04:52.319065+00:00", "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests. not_affected \u2014 CVE-2019-10241 (XSS in directory listings) is not present in target version 9.4.51.v20230217. The upstream fix (commit 1565b5f160e) was already shipped in this release before TuxCare onboarding. The fix includes: (1) getFileName() method with proper URL decoding via UrlEncoded.decodeString(), (2) hrefEncodeURI() encoding dangerous characters in href attributes, (3) deTag() sanitizing displayed ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10241" }, "impact_statement": "not_affected \u2014 CVE-2019-10241 (XSS in directory listings) is not present in target version 9.4.51.v20230217. The upstream fix (commit 1565b5f160e) was already shipped in this release before TuxCare onboarding. The fix includes: (1) getFileName() method with proper URL decoding via UrlEncoded.decodeString(), (2) hrefEncodeURI() encoding dangerous characters in href attributes, (3) deTag() sanitizing displayed ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2019-10246 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2019-10246" }, "action_statement": "Vulnerability CVE-2019-10246 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-31T16:26:55.085443+00:00", "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests. not_affected \u2014 CVE-2019-10247 does not affect this target. The vulnerability requires DefaultHandler to call context.toString() in 404 error responses, which reveals the configured filesystem directory base resource location. The target version 9.4.51.v20230217 contains upstream fixes (commits 04c994712c0 and 9f506e4123b by Joakim Erdfelt) that removed all context.toString() calls from the error output before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10247" }, "impact_statement": "not_affected \u2014 CVE-2019-10247 does not affect this target. The vulnerability requires DefaultHandler to call context.toString() in 404 error responses, which reveals the configured filesystem directory base resource location. The target version 9.4.51.v20230217 contains upstream fixes (commits 04c994712c0 and 9f506e4123b by Joakim Erdfelt) that removed all context.toString() calls from the error output before..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2019-17632 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2019-17632" }, "action_statement": "Vulnerability CVE-2019-17632 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2019-17638 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2019-17638" }, "action_statement": "Vulnerability CVE-2019-17638 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2020-27218 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2020-27218" }, "action_statement": "Vulnerability CVE-2020-27218 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2020-27223 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2020-27223" }, "action_statement": "Vulnerability CVE-2020-27223 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-28T22:26:53.294923+00:00", "status_notes": "Vulnerability CVE-2021-28165 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2021-28165" }, "action_statement": "Vulnerability CVE-2021-28165 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-09-30T16:08:06.197770+00:00", "status_notes": "Vulnerability CVE-2021-34428 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests. not_affected \u2014 CVE-2021-34428 is a Jetty session-invalidation flaw: if an application's SessionListener#sessionDestroyed() throws, the pre-fix Session.invalidate() skipped SessionIdManager.invalidateAll(), leaving the session ID registered in the ID manager. On clustered / multi-context deployments the session stays valid and a user can remain logged in on a shared computer. The upstream fix (commit 087f486b4461, \"Issue #6277 Better handling of exceptions thrown in sessionDestroyed\", tagged jetty-9.4.41.v20210516) wraps the destroy-listener call in try/catch(Exception) and moves getSessionIdManager().invalidateAll(id) into the finally block so ID removal always runs. Target is jetty-9.4.51.v20230217 (newer than the 9.4.41 fix). Session.java lines 942-958 contain the exact post-fix try/catch/finally; git blame attributes the catch (947-949) and the invalidateAll-in-finally (956-957) to the patch commit itself, authored by Jan Bartel (upstream Webtide). The fix is stock upstream baked into the onboarded release (ancestor of both parents of the TuxCare onboarding merge; not introduced by it), not a TuxCare backport. Verdict: not_affected \u2014 upstream fix already present in the shipped version; vulnerable pattern absent from HEAD. Justification: code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-23; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-34428" }, "impact_statement": "not_affected \u2014 CVE-2021-34428 is a Jetty session-invalidation flaw: if an application's SessionListener#sessionDestroyed() throws, the pre-fix Session.invalidate() skipped SessionIdManager.invalidateAll(), leaving the session ID registered in the ID manager. On clustered / multi-context deployments the session stays valid and a user can remain logged in on a shared computer. The upstream fix (commit 087f486b4461, \"Issue #6277 Better handling of exceptions thrown in sessionDestroyed\", tagged jetty-9.4.41.v20210516) wraps the destroy-listener call in try/catch(Exception) and moves getSessionIdManager().invalidateAll(id) into the finally block so ID removal always runs. Target is jetty-9.4.51.v20230217 (newer than the 9.4.41 fix). Session.java lines 942-958 contain the exact post-fix try/catch/finally; git blame attributes the catch (947-949) and the invalidateAll-in-finally (956-957) to the patch commit itself, authored by Jan Bartel (upstream Webtide). The fix is stock upstream baked into the onboarded release (ancestor of both parents of the TuxCare onboarding merge; not introduced by it), not a TuxCare backport. Verdict: not_affected \u2014 upstream fix already present in the shipped version; vulnerable pattern absent from HEAD. Justification: code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-23; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-31T14:43:58.583239+00:00", "status_notes": "Vulnerability CVE-2022-2047 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests. not_affected \u2014 CVE-2022-2047: Target version 9.4.51.v20230217 is NOT AFFECTED. The fix for incorrect URI authority parsing (commit 4ca8afbbd66) was already included in upstream Jetty 9.4.47.v20220610, shipped months before the 9.4.51.v20230217 release that TuxCare onboarded. All defense mechanisms are present and active: isPathValidForAuthority() validation (lines 1042-1049), setAuthority/setPath/setPathQuery...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-2047" }, "impact_statement": "not_affected \u2014 CVE-2022-2047: Target version 9.4.51.v20230217 is NOT AFFECTED. The fix for incorrect URI authority parsing (commit 4ca8afbbd66) was already included in upstream Jetty 9.4.47.v20220610, shipped months before the 9.4.51.v20230217 release that TuxCare onboarded. All defense mechanisms are present and active: isPathValidForAuthority() validation (lines 1042-1049), setAuthority/setPath/setPathQuery..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2022-2191 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2022-2191" }, "action_statement": "Vulnerability CVE-2022-2191 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-31T15:36:43.900585+00:00", "status_notes": "Vulnerability CVE-2023-26048 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests. not_affected \u2014 The target repository (Jetty 9.4.51.v20230217-tuxcare.1) is not affected by CVE-2023-26048. The vulnerability pattern has been removed by an upstream fix (PR #9345, commit c3021592218) that was already present in the upstream Jetty 9.4.51.v20230217 release before TuxCare onboarded it. Both defense mechanisms are present and active by default: (1) part count limiting with DEFAULT_MAX_FORM_KEYS=1...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26048" }, "impact_statement": "not_affected \u2014 The target repository (Jetty 9.4.51.v20230217-tuxcare.1) is not affected by CVE-2023-26048. The vulnerability pattern has been removed by an upstream fix (PR #9345, commit c3021592218) that was already present in the upstream Jetty 9.4.51.v20230217 release before TuxCare onboarded it. Both defense mechanisms are present and active by default: (1) part count limiting with DEFAULT_MAX_FORM_KEYS=1..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-31T15:04:00.095012+00:00", "status_notes": "Vulnerability CVE-2023-26049 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests. not_affected \u2014 CVE-2023-26049 (cookie smuggling via semicolons in quoted values) does not affect this target. The upstream vendor fix (commit 1be1401bafb, PR #9352) was already present in the Eclipse Jetty 9.4.51.v20230217 release that TuxCare onboarded. The fix adds a 'reject' flag that is set when a semicolon is found inside a quoted cookie value (in RFC6265 compliance mode, which is the default), preventin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26049" }, "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via semicolons in quoted values) does not affect this target. The upstream vendor fix (commit 1be1401bafb, PR #9352) was already present in the Eclipse Jetty 9.4.51.v20230217 release that TuxCare onboarded. The fix adds a 'reject' flag that is set when a semicolon is found inside a quoted cookie value (in RFC6265 compliance mode, which is the default), preventin..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-09-30T16:08:06.197770+00:00", "status_notes": "Vulnerability CVE-2023-40167 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2023-40167" }, "action_statement": "Vulnerability CVE-2023-40167 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-09-30T16:08:06.197770+00:00", "status_notes": "Vulnerability CVE-2024-13009 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2024-13009" }, "action_statement": "Vulnerability CVE-2024-13009 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-09-30T16:08:06.197770+00:00", "status_notes": "Vulnerability CVE-2024-6763 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2024-6763" }, "action_statement": "Vulnerability CVE-2024-6763 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2024-7708 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2024-7708" }, "action_statement": "Vulnerability CVE-2024-7708 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-09-30T16:08:06.197770+00:00", "status_notes": "Vulnerability CVE-2024-8184 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2024-8184" }, "action_statement": "Vulnerability CVE-2024-8184 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-09-30T16:08:06.197770+00:00", "status_notes": "Vulnerability CVE-2025-11143 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2025-11143" }, "action_statement": "Vulnerability CVE-2025-11143 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-09-30T16:08:06.197770+00:00", "status_notes": "Vulnerability CVE-2026-10050 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2026-10050" }, "action_statement": "Vulnerability CVE-2026-10050 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-09-30T16:08:06.197770+00:00", "status_notes": "Vulnerability CVE-2026-10051 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests. not_affected \u2014 Jetty 9.4.51.v20230217 is not affected by CVE-2026-10051 because the vulnerable pattern (trailers not being cleared between requests) does not exist in this version. The CVE describes a vulnerability in Jetty 12.x's HttpConnection where the _trailers field was never cleared between HTTP/1.1 keep-alive requests. However, Jetty 9.4.x uses a different architecture (HttpChannelOverHttp) that proper...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-10051" }, "impact_statement": "not_affected \u2014 Jetty 9.4.51.v20230217 is not affected by CVE-2026-10051 because the vulnerable pattern (trailers not being cleared between requests) does not exist in this version. The CVE describes a vulnerability in Jetty 12.x's HttpConnection where the _trailers field was never cleared between HTTP/1.1 keep-alive requests. However, Jetty 9.4.x uses a different architecture (HttpChannelOverHttp) that proper..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-09-30T16:08:06.197770+00:00", "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests. Jetty 9.4.51.v20230217 uses a fundamentally different architecture than the vulnerable Jetty 12.x described in CVE-2026-1605. The CVE-specific vulnerability pattern requires GzipRequest with InflaterPool where cleanup is conditional on response deflation. Jetty 9.4.51 lacks these components entirely (GzipRequest, GzipResponseAndCallback, pooled Inflaters) and instead uses GzipHttpInputInterceptor with direct Inflater creation and deferred cleanup via HttpInput.recycle(). The specific chain from Input to Goal (pool exhaustion leading to permanent memory leak) is not reachable in this version's architecture.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-1605" }, "impact_statement": "Jetty 9.4.51.v20230217 uses a fundamentally different architecture than the vulnerable Jetty 12.x described in CVE-2026-1605. The CVE-specific vulnerability pattern requires GzipRequest with InflaterPool where cleanup is conditional on response deflation. Jetty 9.4.51 lacks these components entirely (GzipRequest, GzipResponseAndCallback, pooled Inflaters) and instead uses GzipHttpInputInterceptor with direct Inflater creation and deferred cleanup via HttpInput.recycle(). The specific chain from Input to Goal (pool exhaustion leading to permanent memory leak) is not reachable in this version's architecture." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-15T09:59:09.094507+00:00", "status_notes": "Vulnerability CVE-2026-18659 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2026-18659" }, "action_statement": "Vulnerability CVE-2026-18659 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-15T09:59:09.094507+00:00", "status_notes": "Vulnerability CVE-2026-18662 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2026-18662" }, "action_statement": "Vulnerability CVE-2026-18662 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-10-15T09:59:09.094507+00:00", "status_notes": "Vulnerability CVE-2026-19864 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2026-19864" }, "action_statement": "Vulnerability CVE-2026-19864 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-09-30T16:08:06.197770+00:00", "status_notes": "Vulnerability CVE-2026-2332 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2026-2332" }, "action_statement": "Vulnerability CVE-2026-2332 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-09-30T16:08:06.197770+00:00", "status_notes": "Vulnerability CVE-2026-6790 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests.", "vulnerability": { "name": "CVE-2026-6790" }, "action_statement": "Vulnerability CVE-2026-6790 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty.websocket/jetty-websocket-tests@9.4.51.v20230217-tuxcare.1" } } ], "timestamp": "2026-09-30T16:08:06.197770+00:00", "status_notes": "Vulnerability CVE-2026-8384 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty.websocket:jetty-websocket-tests. not_affected \u2014 The target (Jetty 9.4.51.v20230217) is not affected by CVE-2026-8384. While the CVE describes a path normalization bypass in Jetty 12.1.8 where URIUtil.canonicalPath() fails to normalize paths containing `;/../` patterns due to incorrect slash-state tracking, Jetty 9.4.x uses a fundamentally different two-step architecture that prevents this vulnerability. The target's HttpURI.getDecodedPath() ...", "vulnerability": { "name": "CVE-2026-8384" }, "impact_statement": "not_affected \u2014 The target (Jetty 9.4.51.v20230217) is not affected by CVE-2026-8384. While the CVE describes a path normalization bypass in Jetty 12.1.8 where URIUtil.canonicalPath() fails to normalize paths containing `;/../` patterns due to incorrect slash-state tracking, Jetty 9.4.x uses a fundamentally different two-step architecture that prevents this vulnerability. The target's HttpURI.getDecodedPath() ..." } ] }