{ "@id": "urn:uuid:7061633b-aedf-4367-b093-8fe6ed777e38", "role": "Document Creator", "author": "https://tuxcare.com", "version": 19, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-31T16:33:00.158215+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2006-6969 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2006-6969" }, "action_statement": "Vulnerability CVE-2006-6969 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2011-4461 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2011-4461" }, "action_statement": "Vulnerability CVE-2011-4461 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2015-2080 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2015-2080" }, "action_statement": "Vulnerability CVE-2015-2080 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-29T07:31:18.734944+00:00", "status_notes": "Vulnerability CVE-2016-4800 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2016-4800" }, "action_statement": "Vulnerability CVE-2016-4800 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2017-7656 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2017-7656" }, "action_statement": "Vulnerability CVE-2017-7656 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-28T22:31:54.607962+00:00", "status_notes": "Vulnerability CVE-2017-7657 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2017-7657" }, "action_statement": "Vulnerability CVE-2017-7657 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-28T22:26:53.294923+00:00", "status_notes": "Vulnerability CVE-2017-7658 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2017-7658" }, "action_statement": "Vulnerability CVE-2017-7658 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-28T22:26:53.294923+00:00", "status_notes": "Vulnerability CVE-2017-9735 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2017-9735" }, "action_statement": "Vulnerability CVE-2017-9735 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-28T22:26:53.294923+00:00", "status_notes": "Vulnerability CVE-2018-12536 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2018-12536" }, "action_statement": "Vulnerability CVE-2018-12536 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2018-12538" }, "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-29T00:08:54.384014+00:00", "status_notes": "Vulnerability CVE-2018-12545 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2018-12545" }, "action_statement": "Vulnerability CVE-2018-12545 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-31T16:09:23.378795+00:00", "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded. not_affected \u2014 CVE-2019-10241 (XSS in directory listings) is NOT present in target version 9.4.58.v20250814. The vulnerability was fixed in upstream commit 3d028ab2ca7 (Issue #3549) by Joakim Erdfelt, which added the getFileName() method to extract only the filename (last path segment) instead of using full paths in directory listing HTML. This fix was already present in upstream release 9.4.58 when TuxCare o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10241" }, "impact_statement": "not_affected \u2014 CVE-2019-10241 (XSS in directory listings) is NOT present in target version 9.4.58.v20250814. The vulnerability was fixed in upstream commit 3d028ab2ca7 (Issue #3549) by Joakim Erdfelt, which added the getFileName() method to extract only the filename (last path segment) instead of using full paths in directory listing HTML. This fix was already present in upstream release 9.4.58 when TuxCare o..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-28T23:37:14.382670+00:00", "status_notes": "Vulnerability CVE-2019-10246 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2019-10246" }, "action_statement": "Vulnerability CVE-2019-10246 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-31T16:33:00.158215+00:00", "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded. not_affected \u2014 Target version 9.4.58.v20250814 is not affected by CVE-2019-10247. The vulnerability (information disclosure of filesystem paths via context.toString() in 404 error pages) was fixed by upstream commit 04c994712c0 authored by Joakim Erdfelt, which shipped in the upstream release before TuxCare onboarded this version. The vulnerable code pattern (outputting context.toString() which includes base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-10247" }, "impact_statement": "not_affected \u2014 Target version 9.4.58.v20250814 is not affected by CVE-2019-10247. The vulnerability (information disclosure of filesystem paths via context.toString() in 404 error pages) was fixed by upstream commit 04c994712c0 authored by Joakim Erdfelt, which shipped in the upstream release before TuxCare onboarded this version. The vulnerable code pattern (outputting context.toString() which includes base ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2019-17632 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2019-17632" }, "action_statement": "Vulnerability CVE-2019-17632 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2019-17638 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2019-17638" }, "action_statement": "Vulnerability CVE-2019-17638 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2020-27218 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2020-27218" }, "action_statement": "Vulnerability CVE-2020-27218 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2020-27223 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2020-27223" }, "action_statement": "Vulnerability CVE-2020-27223 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-28T22:26:53.294923+00:00", "status_notes": "Vulnerability CVE-2021-28165 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2021-28165" }, "action_statement": "Vulnerability CVE-2021-28165 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-34428 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2021-34428" }, "action_statement": "Vulnerability CVE-2021-34428 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-31T14:36:43.933701+00:00", "status_notes": "Vulnerability CVE-2022-2047 does not affect version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded. not_affected \u2014 CVE-2022-2047 is NOT present in target version 9.4.58.v20250814. The upstream fix (commit 4ca8afbbd667c19a084d5ff14a4f08eb7049d1c7 by Simone Bordet) was already included in the upstream Jetty release that TuxCare onboarded. The fix adds validation in HttpURI.setAuthority(), setPath(), and setPathQuery() to reject relative paths (not starting with \"/\") when an authority is present, preventing mi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-2047" }, "impact_statement": "not_affected \u2014 CVE-2022-2047 is NOT present in target version 9.4.58.v20250814. The upstream fix (commit 4ca8afbbd667c19a084d5ff14a4f08eb7049d1c7 by Simone Bordet) was already included in the upstream Jetty release that TuxCare onboarded. The fix adds validation in HttpURI.setAuthority(), setPath(), and setPathQuery() to reject relative paths (not starting with \"/\") when an authority is present, preventing mi..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2022-2191 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2022-2191" }, "action_statement": "Vulnerability CVE-2022-2191 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-31T15:31:19.425136+00:00", "status_notes": "Vulnerability CVE-2023-26048 does not affect version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded. not_affected \u2014 Target version 9.4.58.v20250814 is NOT affected by CVE-2023-26048. The vulnerability (unbounded memory buffering of multipart parts without filename) was fixed in upstream Jetty 9.4.51.v20230217 and is not present in this version. Both required defenses are implemented: (1) content-size validation for parts-without-filename (Request.java:2523-2525) that throws IllegalStateException when cumulat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26048" }, "impact_statement": "not_affected \u2014 Target version 9.4.58.v20250814 is NOT affected by CVE-2023-26048. The vulnerability (unbounded memory buffering of multipart parts without filename) was fixed in upstream Jetty 9.4.51.v20230217 and is not present in this version. Both required defenses are implemented: (1) content-size validation for parts-without-filename (Request.java:2523-2525) that throws IllegalStateException when cumulat..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-31T14:59:00.074352+00:00", "status_notes": "Vulnerability CVE-2023-26049 does not affect version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded. not_affected \u2014 CVE-2023-26049 (cookie smuggling via nonstandard quoted-value parsing) is NOT present in target Jetty 9.4.58.v20250814. The upstream fix (commit 1be1401bafb) was authored by gregw@webtide.com and shipped in Jetty 9.4.51.v20230217 (February 2023), over 2 years before TuxCare onboarded version 9.4.58.v20250814. The vulnerable pattern (parsing semicolons inside quoted cookie values as part of the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-26049" }, "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via nonstandard quoted-value parsing) is NOT present in target Jetty 9.4.58.v20250814. The upstream fix (commit 1be1401bafb) was authored by gregw@webtide.com and shipped in Jetty 9.4.51.v20230217 (February 2023), over 2 years before TuxCare onboarded version 9.4.58.v20250814. The vulnerable pattern (parsing semicolons inside quoted cookie values as part of the ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40167 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2023-40167" }, "action_statement": "Vulnerability CVE-2023-40167 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-28T23:59:58.436178+00:00", "status_notes": "Vulnerability CVE-2024-13009 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2024-13009" }, "action_statement": "Vulnerability CVE-2024-13009 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6763 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2024-6763" }, "action_statement": "Vulnerability CVE-2024-6763 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2024-7708 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2024-7708" }, "action_statement": "Vulnerability CVE-2024-7708 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8184 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2024-8184" }, "action_statement": "Vulnerability CVE-2024-8184 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11143 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2025-11143" }, "action_statement": "Vulnerability CVE-2025-11143 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10051 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2026-10051" }, "action_statement": "Vulnerability CVE-2026-10051 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1605 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2026-1605" }, "action_statement": "Vulnerability CVE-2026-1605 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2332 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2026-2332" }, "action_statement": "Vulnerability CVE-2026-2332 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6790 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded.", "vulnerability": { "name": "CVE-2026-6790" }, "action_statement": "Vulnerability CVE-2026-6790 affects version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/infinispan-embedded@9.4.58.v20250814-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8384 does not affect version 9.4.58.v20250814-tuxcare.3 of org.eclipse.jetty:infinispan-embedded. not_affected \u2014 Jetty 9.4.58.v20250814 is not affected by CVE-2026-8384. The vulnerability exists only in Jetty 12's refactored canonicalPath() implementation that combines path decoding and canonicalization with slash-state tracking. Jetty 9.4 uses a two-stage architecture (decodePath() followed by canonicalPath()) that correctly normalizes paths containing semicolon path parameters before dot-dot segments, p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-8384" }, "impact_statement": "not_affected \u2014 Jetty 9.4.58.v20250814 is not affected by CVE-2026-8384. The vulnerability exists only in Jetty 12's refactored canonicalPath() implementation that combines path decoding and canonicalization with slash-state tracking. Jetty 9.4 uses a two-stage architecture (decodePath() followed by canonicalPath()) that correctly normalizes paths containing semicolon path parameters before dot-dot segments, p..." } ] }