{ "@id": "urn:uuid:7c5455af-8ab5-4d8c-a690-afb096362fa6", "role": "Document Creator", "author": "https://tuxcare.com", "version": 21, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-31T17:58:07.155505+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2006-6969 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2006-6969" }, "action_statement": "Vulnerability CVE-2006-6969 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-28T23:41:42.084809+00:00", "status_notes": "Vulnerability CVE-2011-4461 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2011-4461" }, "action_statement": "Vulnerability CVE-2011-4461 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2015-2080 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2015-2080" }, "action_statement": "Vulnerability CVE-2015-2080 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2016-4800 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2016-4800" }, "action_statement": "Vulnerability CVE-2016-4800 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2017-7656 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2017-7656" }, "action_statement": "Vulnerability CVE-2017-7656 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2017-7657 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2017-7657" }, "action_statement": "Vulnerability CVE-2017-7657 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2017-7658 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2017-7658" }, "action_statement": "Vulnerability CVE-2017-7658 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2017-9735 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2017-9735" }, "action_statement": "Vulnerability CVE-2017-9735 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-31T17:58:07.155505+00:00", "status_notes": "Vulnerability CVE-2018-12536 does not affect version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded. not_affected \u2014 CVE-2018-12536 describes path disclosure in Jetty 9.x when InvalidPathException containing full server paths is included in error responses. The target version 9.4.57.v20241219 is NOT affected because ResourceContentFactory.getContent() wraps all resource loading operations in a try-catch block that sanitizes exceptions, re-throwing InvalidPathException with only the request path (not system pa...", "vulnerability": { "name": "CVE-2018-12536" }, "impact_statement": "not_affected \u2014 CVE-2018-12536 describes path disclosure in Jetty 9.x when InvalidPathException containing full server paths is included in error responses. The target version 9.4.57.v20241219 is NOT affected because ResourceContentFactory.getContent() wraps all resource loading operations in a try-catch block that sanitizes exceptions, re-throwing InvalidPathException with only the request path (not system pa..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2018-12538" }, "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2018-12545 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2018-12545" }, "action_statement": "Vulnerability CVE-2018-12545 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-31T15:56:00.085929+00:00", "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded. not_affected \u2014 CVE-2019-10241 XSS vulnerability in directory listings is NOT present in this target. The upstream fix (commit 7b774d82e82, April 2019) was already included in the Jetty 9.4.57.v20241219 release that TuxCare onboarded. The vulnerable pattern where full paths could be exposed in directory listings has been replaced with the secure getFileName() method that extracts only the filename component.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10241" }, "impact_statement": "not_affected \u2014 CVE-2019-10241 XSS vulnerability in directory listings is NOT present in this target. The upstream fix (commit 7b774d82e82, April 2019) was already included in the Jetty 9.4.57.v20241219 release that TuxCare onboarded. The vulnerable pattern where full paths could be exposed in directory listings has been replaced with the secure getFileName() method that extracts only the filename component." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2019-10246 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2019-10246" }, "action_statement": "Vulnerability CVE-2019-10246 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-31T16:20:00.151886+00:00", "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded. not_affected \u2014 CVE-2019-10247 is NOT present in this version. The vulnerability involved DefaultHandler's 404 error response revealing filesystem paths via context.toString() output. The target version 9.4.57.v20241219 contains upstream fixes (commits 04c994712c0 and 9f506e4123b) that removed the context.toString() call, preventing filesystem path disclosure. These fixes were authored by upstream Jetty develo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10247" }, "impact_statement": "not_affected \u2014 CVE-2019-10247 is NOT present in this version. The vulnerability involved DefaultHandler's 404 error response revealing filesystem paths via context.toString() output. The target version 9.4.57.v20241219 contains upstream fixes (commits 04c994712c0 and 9f506e4123b) that removed the context.toString() call, preventing filesystem path disclosure. These fixes were authored by upstream Jetty develo..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2019-17632 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2019-17632" }, "action_statement": "Vulnerability CVE-2019-17632 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2019-17638 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2019-17638" }, "action_statement": "Vulnerability CVE-2019-17638 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2020-27218 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2020-27218" }, "action_statement": "Vulnerability CVE-2020-27218 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2020-27223 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2020-27223" }, "action_statement": "Vulnerability CVE-2020-27223 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2021-28165 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2021-28165" }, "action_statement": "Vulnerability CVE-2021-28165 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-34428 does not affect version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded. Version 9.4.57.v20241219 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.", "vulnerability": { "name": "CVE-2021-34428" }, "impact_statement": "Version 9.4.57.v20241219 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-31T14:34:00.152066+00:00", "status_notes": "Vulnerability CVE-2022-2047 does not affect version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded. not_affected \u2014 CVE-2022-2047 is NOT present in target version 9.4.57.v20241219. The vulnerability involved HttpURI incorrectly parsing URIs with semicolons in authority sections (e.g., `http://localhost;/path`) and accepting relative paths with authority components, which violates URI syntax rules. The upstream fix (commit 4ca8afbbd667c19a084d5ff14a4f08eb7049d1c7, authored by Simone Bordet) was already includ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-2047" }, "impact_statement": "not_affected \u2014 CVE-2022-2047 is NOT present in target version 9.4.57.v20241219. The vulnerability involved HttpURI incorrectly parsing URIs with semicolons in authority sections (e.g., `http://localhost;/path`) and accepting relative paths with authority components, which violates URI syntax rules. The upstream fix (commit 4ca8afbbd667c19a084d5ff14a4f08eb7049d1c7, authored by Simone Bordet) was already includ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2022-2191 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2022-2191" }, "action_statement": "Vulnerability CVE-2022-2191 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-31T15:26:37.896727+00:00", "status_notes": "Vulnerability CVE-2023-26048 does not affect version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded. not_affected \u2014 CVE-2023-26048 is not present in target version 9.4.57.v20241219. The upstream fix was already included in this release. The fix adds two defenses: (1) a part count limit (_maxParts, default 1000) that prevents processing excessive numbers of multipart parts, and (2) a form content size limit (maxFormContentSize) that prevents unbounded memory consumption from parts without filenames. Both defe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26048" }, "impact_statement": "not_affected \u2014 CVE-2023-26048 is not present in target version 9.4.57.v20241219. The upstream fix was already included in this release. The fix adds two defenses: (1) a part count limit (_maxParts, default 1000) that prevents processing excessive numbers of multipart parts, and (2) a form content size limit (maxFormContentSize) that prevents unbounded memory consumption from parts without filenames. Both defe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-31T14:56:00.131765+00:00", "status_notes": "Vulnerability CVE-2023-26049 does not affect version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded. not_affected \u2014 CVE-2023-26049 describes a cookie smuggling vulnerability where Jetty's nonstandard cookie parsing allows an attacker to embed semicolons within quoted cookie values, bypassing normal cookie separation. The target repository (Jetty 9.4.57.v20241219) is NOT AFFECTED because the upstream fix was already included in the 9.4.57 release. The fix (commit 1be1401, authored by gregw@webtide.com) adds s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26049" }, "impact_statement": "not_affected \u2014 CVE-2023-26049 describes a cookie smuggling vulnerability where Jetty's nonstandard cookie parsing allows an attacker to embed semicolons within quoted cookie values, bypassing normal cookie separation. The target repository (Jetty 9.4.57.v20241219) is NOT AFFECTED because the upstream fix was already included in the 9.4.57 release. The fix (commit 1be1401, authored by gregw@webtide.com) adds s..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40167 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2023-40167" }, "action_statement": "Vulnerability CVE-2023-40167 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2024-13009 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2024-13009" }, "action_statement": "Vulnerability CVE-2024-13009 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6763 does not affect version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-6763" }, "impact_statement": "fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable" }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2024-7708 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2024-7708" }, "action_statement": "Vulnerability CVE-2024-7708 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8184 does not affect version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded. Version 9.4.57.v20241219 is not vulnerable. Summary: The target repository has already been patched for CVE-2024-8184. The vulnerable get/putIfAbsent pattern has been replaced with atomic compute operations and reference counting, preventing the memory leak that causes DoS. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-8184" }, "impact_statement": "Version 9.4.57.v20241219 is not vulnerable. Summary: The target repository has already been patched for CVE-2024-8184. The vulnerable get/putIfAbsent pattern has been replaced with atomic compute operations and reference counting, preventing the memory leak that causes DoS. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11143 is fixed in version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2025-11143" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10051 does not affect version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded. not_affected \u2014 Jetty 9.4.57.v20241219-tuxcare.4 is NOT affected by CVE-2026-10051. The vulnerability targets Jetty 12.x architecture where the _trailers field in HttpConnection was never reset between requests. Jetty 9.4.57 uses a different architecture where _trailers fields exist in HttpChannelOverHttp and HttpChannel classes, and BOTH are properly cleared to null in their respective recycle() methods, whic...", "vulnerability": { "name": "CVE-2026-10051" }, "impact_statement": "not_affected \u2014 Jetty 9.4.57.v20241219-tuxcare.4 is NOT affected by CVE-2026-10051. The vulnerability targets Jetty 12.x architecture where the _trailers field in HttpConnection was never reset between requests. Jetty 9.4.57 uses a different architecture where _trailers fields exist in HttpChannelOverHttp and HttpChannel classes, and BOTH are properly cleared to null in their respective recycle() methods, whic..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded. Version 9.4.57.v20241219 is not vulnerable. Summary: Target repository is Jetty 9.4.57.v20241219, which is not in the affected version range for CVE-2026-1605 (Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5). The architecture and resource management patterns are fundamentally different from Jetty 12.x, and the specific vulnerability pattern does not exist in this version. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1605" }, "impact_statement": "Version 9.4.57.v20241219 is not vulnerable. Summary: Target repository is Jetty 9.4.57.v20241219, which is not in the affected version range for CVE-2026-1605 (Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5). The architecture and resource management patterns are fundamentally different from Jetty 12.x, and the specific vulnerability pattern does not exist in this version. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2332 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2026-2332" }, "action_statement": "Vulnerability CVE-2026-2332 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6790 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2026-6790" }, "action_statement": "Vulnerability CVE-2026-6790 affects version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.57.v20241219-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8384 does not affect version 9.4.57.v20241219-tuxcare.6 of org.eclipse.jetty:infinispan-embedded. not_affected \u2014 The target Jetty 9.4.57.v20241219 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8's unified canonicalPath() method which handles both semicolon stripping and dot normalization in a single pass. Jetty 9.4 uses a fundamentally different two-pass architecture where decodePath() strips semicolons first, then canonicalPath() normalizes dot segments. The specific vulnerabil...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-8384" }, "impact_statement": "not_affected \u2014 The target Jetty 9.4.57.v20241219 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8's unified canonicalPath() method which handles both semicolon stripping and dot normalization in a single pass. Jetty 9.4 uses a fundamentally different two-pass architecture where decodePath() strips semicolons first, then canonicalPath() normalizes dot segments. The specific vulnerabil..." } ] }