{
  "@id": "urn:uuid:8d63b2b6-97d5-4a04-ac5e-21571b7e820f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T17:57:00.090611+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "action_statement": "Vulnerability CVE-2006-6969 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:41:42.084809+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "action_statement": "Vulnerability CVE-2011-4461 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "action_statement": "Vulnerability CVE-2015-2080 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "action_statement": "Vulnerability CVE-2016-4800 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "action_statement": "Vulnerability CVE-2017-7656 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "action_statement": "Vulnerability CVE-2017-7658 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "action_statement": "Vulnerability CVE-2017-9735 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T17:57:00.090611+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 The target repository (Jetty 11.0.19) is NOT affected by CVE-2018-12536. The vulnerability involved path disclosure through unhandled InvalidPathException messages when bad characters in HTTP request paths triggered filesystem exceptions. The fix was already present in the upstream Jetty 11.0.19 release that TuxCare onboarded. Upstream commit ad4dceb1c08679baa2a6a64356fcde5309e13fd8 (May 31, 20...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 11.0.19) is NOT affected by CVE-2018-12536. The vulnerability involved path disclosure through unhandled InvalidPathException messages when bad characters in HTTP request paths triggered filesystem exceptions. The fix was already present in the upstream Jetty 11.0.19 release that TuxCare onboarded. Upstream commit ad4dceb1c08679baa2a6a64356fcde5309e13fd8 (May 31, 20..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "action_statement": "Vulnerability CVE-2018-12545 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T15:59:37.450285+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 CVE-2019-10241 is an XSS vulnerability in Jetty's directory listing feature where specially formatted URLs could cause unescaped special characters or full filesystem paths to be rendered in HTML output. The upstream fix (commit 7b774d82e82 by Joakim Erdfelt, April 2019) introduced the getFileName() method that extracts only the filename segment and URL-decodes it properly. This fix was already...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10241 is an XSS vulnerability in Jetty's directory listing feature where specially formatted URLs could cause unescaped special characters or full filesystem paths to be rendered in HTML output. The upstream fix (commit 7b774d82e82 by Joakim Erdfelt, April 2019) introduced the getFileName() method that extracts only the filename segment and URL-decodes it properly. This fix was already..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "action_statement": "Vulnerability CVE-2019-10246 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T16:22:37.986453+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 CVE-2019-10247 is not present in Jetty 11.0.19. The vulnerability involved DefaultHandler revealing filesystem paths via context.toString() in 404 error pages. The fix (commit 04c99471 from April 2019) was already included in upstream Jetty 11.0.19 when TuxCare onboarded it in January 2026. Current DefaultHandler code (lines 142-182) outputs only safe context information (path, display name, st...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247 is not present in Jetty 11.0.19. The vulnerability involved DefaultHandler revealing filesystem paths via context.toString() in 404 error pages. The fix (commit 04c99471 from April 2019) was already included in upstream Jetty 11.0.19 when TuxCare onboarded it in January 2026. Current DefaultHandler code (lines 142-182) outputs only safe context information (path, display name, st..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "action_statement": "Vulnerability CVE-2019-17632 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "action_statement": "Vulnerability CVE-2019-17638 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "action_statement": "Vulnerability CVE-2020-27218 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "action_statement": "Vulnerability CVE-2020-27223 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "action_statement": "Vulnerability CVE-2021-28165 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T15:16:00.096279+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 CVE-2021-34428 is not present in Jetty 11.0.19. The vulnerability concerns session ID invalidation failure when SessionListener.sessionDestroyed() throws an exception. The upstream fix (commit cd6462a6252 by Jan Bartel, dated May 16, 2021) was already included in the Jetty 11.0.19 release that TuxCare onboarded. The fix wraps callSessionDestroyedListeners() in try-catch and moves invalidateAll(...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34428 is not present in Jetty 11.0.19. The vulnerability concerns session ID invalidation failure when SessionListener.sessionDestroyed() throws an exception. The upstream fix (commit cd6462a6252 by Jan Bartel, dated May 16, 2021) was already included in the Jetty 11.0.19 release that TuxCare onboarded. The fix wraps callSessionDestroyedListeners() in try-catch and moves invalidateAll(..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T14:42:00.201493+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 CVE-2022-2047 is NOT present in the target. The vulnerability, which allowed malformed URIs like `http://localhost;/path` to be parsed with `localhost;` (including semicolon) as the host value, has been fixed by upstream commit d1e64f469362bb9371d530cccded5ecb13fa1cb5. This fix was already present in Jetty 11.0.19 when TuxCare onboarded it. The defense mechanisms are intact: isPathValidForAutho...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2047 is NOT present in the target. The vulnerability, which allowed malformed URIs like `http://localhost;/path` to be parsed with `localhost;` (including semicolon) as the host value, has been fixed by upstream commit d1e64f469362bb9371d530cccded5ecb13fa1cb5. This fix was already present in Jetty 11.0.19 when TuxCare onboarded it. The defense mechanisms are intact: isPathValidForAutho..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "action_statement": "Vulnerability CVE-2022-2191 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T15:32:58.011211+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 CVE-2023-26048 (multipart OOM vulnerability) is not present in target Jetty 11.0.19-tuxcare.4. The fix was already included in the upstream Jetty 11.0.19 release that TuxCare onboarded. Both protective mechanisms are present and active by default: (1) part count limited to 1000 via _maxParts check in MultiPartFormInputStream.java:816-818 and MultiPartInputStreamParser.java:694-696; (2) form fie...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26048 (multipart OOM vulnerability) is not present in target Jetty 11.0.19-tuxcare.4. The fix was already included in the upstream Jetty 11.0.19 release that TuxCare onboarded. Both protective mechanisms are present and active by default: (1) part count limited to 1000 via _maxParts check in MultiPartFormInputStream.java:816-818 and MultiPartInputStreamParser.java:694-696; (2) form fie..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T15:05:37.424044+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 Target version 11.0.19 is NOT AFFECTED by CVE-2023-26049. The vulnerability (nonstandard cookie parsing that accepts semicolons inside quoted cookie values, enabling cookie smuggling) was fixed in upstream Jetty commit 7b8c2c1bf08 (Feb 2023) by introducing RFC6265CookieParser with strict quoted-value validation. This fix was already present in the upstream Jetty 11.0.19 release before TuxCare o...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 Target version 11.0.19 is NOT AFFECTED by CVE-2023-26049. The vulnerability (nonstandard cookie parsing that accepts semicolons inside quoted cookie values, enabling cookie smuggling) was fixed in upstream Jetty commit 7b8c2c1bf08 (Feb 2023) by introducing RFC6265CookieParser with strict quoted-value validation. This fix was already present in the upstream Jetty 11.0.19 release before TuxCare o..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T15:48:24.061171+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 Jetty 11.0.19 is NOT affected by CVE-2023-40167. The vulnerability (accepting '+' and other non-digit characters in Content-Length headers via Java's Long.parseLong) was fixed in upstream commit 003e46cae4d (\"Various cleanups in HttpParser\" by gregw@webtide.com, Aug 18, 2023), which replaced permissive Long.parseLong() with strict character-by-character validation rejecting any character outsid...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.19 is NOT affected by CVE-2023-40167. The vulnerability (accepting '+' and other non-digit characters in Content-Length headers via Java's Long.parseLong) was fixed in upstream commit 003e46cae4d (\"Various cleanups in HttpParser\" by gregw@webtide.com, Aug 18, 2023), which replaced permissive Long.parseLong() with strict character-by-character validation rejecting any character outsid..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "action_statement": "Vulnerability CVE-2024-13009 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "action_statement": "Vulnerability CVE-2024-6763 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 is fixed in version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T12:00:44.024119+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote, and is fixed in 11.0.19-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "action_statement": "Vulnerability CVE-2024-8184 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote, and is fixed in 11.0.19-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      },
      "action_statement": "Vulnerability CVE-2025-11143 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 Jetty 11.0.19 is not affected by CVE-2026-10051 (HTTP trailer cross-request leakage). The target version has a fundamentally different architecture from the vulnerable Jetty 12. In Jetty 11, the `_trailers` field is managed in `HttpChannelOverHttp.java` and is reliably reset to null in the `recycle()` method, which is called after each HTTP request completes. This architectural defense prevents...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.19 is not affected by CVE-2026-10051 (HTTP trailer cross-request leakage). The target version has a fundamentally different architecture from the vulnerable Jetty 12. In Jetty 11, the `_trailers` field is managed in `HttpChannelOverHttp.java` and is reliably reset to null in the `recycle()` method, which is called after each HTTP request completes. This architectural defense prevents..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote. Version 11.0.19 is not vulnerable. Summary: Target repository is Jetty 11.0.19, which is not affected by CVE-2026-1605. This CVE specifically affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.1.5). Jetty 11 uses a fundamentally different architecture where request decompression resource cleanup is properly tied to the request lifecycle via HttpInput.recycle(), not to response compression status. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 11.0.19 is not vulnerable. Summary: Target repository is Jetty 11.0.19, which is not affected by CVE-2026-1605. This CVE specifically affects Jetty 12.x (versions 12.0.0-12.0.31 and 12.1.0-12.1.5). Jetty 11 uses a fundamentally different architecture where request decompression resource cleanup is properly tied to the request lifecycle via HttpInput.recycle(), not to response compression status. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      },
      "action_statement": "Vulnerability CVE-2026-2332 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T12:01:00.089427+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote, and is fixed in 11.0.19-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "action_statement": "Vulnerability CVE-2026-6790 affects version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote, and is fixed in 11.0.19-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@11.0.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 11.0.19-tuxcare.3 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 Jetty 11.0.19 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.x due to architectural changes where canonicalPath() processes encoded paths directly with semicolon handling. Version 11.x uses a two-step process (decodePath then canonicalPath) that correctly normalizes paths like /public;/../admin/secret to /admin/secret, preventing security constraint bypass.",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.19 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.x due to architectural changes where canonicalPath() processes encoded paths directly with semicolon handling. Version 11.x uses a two-step process (decodePath then canonicalPath) that correctly normalizes paths like /public;/../admin/secret to /admin/secret, preventing security constraint bypass."
    }
  ]
}