{
  "@id": "urn:uuid:3f63b50b-1182-45d8-91d0-a35eff359b72",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 20,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T17:55:02.198999+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "action_statement": "Vulnerability CVE-2006-6969 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:41:42.084809+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "action_statement": "Vulnerability CVE-2011-4461 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "action_statement": "Vulnerability CVE-2015-2080 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "action_statement": "Vulnerability CVE-2016-4800 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "action_statement": "Vulnerability CVE-2017-7656 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "action_statement": "Vulnerability CVE-2017-7658 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "action_statement": "Vulnerability CVE-2017-9735 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T17:55:02.198999+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server. not_affected \u2014 CVE-2018-12536 is NOT present in Eclipse Jetty 9.4.53.v20231009. The vulnerability, which could leak full filesystem paths via InvalidPathException error messages, was fixed in upstream issue #2560. The fix (commit ad4dceb1c08) wraps resource loading in ResourceContentFactory.getContent() with exception sanitization that replaces any exception with a new InvalidPathException containing only the...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 is NOT present in Eclipse Jetty 9.4.53.v20231009. The vulnerability, which could leak full filesystem paths via InvalidPathException error messages, was fixed in upstream issue #2560. The fix (commit ad4dceb1c08) wraps resource loading in ResourceContentFactory.getContent() with exception sanitization that replaces any exception with a new InvalidPathException containing only the..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "action_statement": "Vulnerability CVE-2018-12545 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:55:00.103766+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server. not_affected \u2014 Target version 9.4.53.v20231009 is not affected by CVE-2019-10241. The upstream fix for the XSS vulnerability in directory listings was applied in April 2019 (commit 7b774d82e82) and was already present in the 9.4.53 release when TuxCare onboarded it. The fix adds proper URL-decoding via getFileName() followed by HTML-escaping via deTag()/sanitizeXmlString(), preventing malicious scripts in URL...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 Target version 9.4.53.v20231009 is not affected by CVE-2019-10241. The upstream fix for the XSS vulnerability in directory listings was applied in April 2019 (commit 7b774d82e82) and was already present in the 9.4.53 release when TuxCare onboarded it. The fix adds proper URL-decoding via getFileName() followed by HTML-escaping via deTag()/sanitizeXmlString(), preventing malicious scripts in URL..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "action_statement": "Vulnerability CVE-2019-10246 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T16:19:00.081142+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server. not_affected \u2014 CVE-2019-10247: Target version 9.4.53.v20231009 is not affected. The vulnerability (information disclosure of base resource directory paths in DefaultHandler's 404 error page) was fixed by upstream commits d983890d176 and 6d847d4a73b in April 2019, removing the vulnerable context.toString() output. The fix was already present in the upstream 9.4.53 release (October 2023) when TuxCare onboarded ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247: Target version 9.4.53.v20231009 is not affected. The vulnerability (information disclosure of base resource directory paths in DefaultHandler's 404 error page) was fixed by upstream commits d983890d176 and 6d847d4a73b in April 2019, removing the vulnerable context.toString() output. The fix was already present in the upstream 9.4.53 release (October 2023) when TuxCare onboarded ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "action_statement": "Vulnerability CVE-2019-17632 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "action_statement": "Vulnerability CVE-2019-17638 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "action_statement": "Vulnerability CVE-2020-27218 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "action_statement": "Vulnerability CVE-2020-27223 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "action_statement": "Vulnerability CVE-2021-28165 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server. Version 9.4.53.v20231009 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "Version 9.4.53.v20231009 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T14:37:51.338194+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server. not_affected \u2014 CVE-2022-2047 is not present in Jetty 9.4.53.v20231009-tuxcare.8. The vulnerability involved incorrect URI parsing where semicolons in URIs like `http://localhost;/path` caused HttpURI to misidentify authority components. The upstream fix (commit 4ca8afbbd667c19a084d5ff14a4f08eb7049d1c7) was introduced in Jetty 9.4.47 and is present in the 9.4.53 release that TuxCare onboarded. All three defens...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2047 is not present in Jetty 9.4.53.v20231009-tuxcare.8. The vulnerability involved incorrect URI parsing where semicolons in URIs like `http://localhost;/path` caused HttpURI to misidentify authority components. The upstream fix (commit 4ca8afbbd667c19a084d5ff14a4f08eb7049d1c7) was introduced in Jetty 9.4.47 and is present in the 9.4.53 release that TuxCare onboarded. All three defens..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "action_statement": "Vulnerability CVE-2022-2191 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:32:58.011211+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 does not affect version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server. not_affected \u2014 The target Jetty 9.4.53.v20231009 is NOT AFFECTED by CVE-2023-26048. The vulnerability (unbounded memory consumption from large non-file multipart parts) was fixed in upstream Jetty 9.4.51.v20230217. The target version 9.4.53 (October 2023) already includes this upstream fix from commit 1042cdb8a54 authored by Lachlan Roberts (lachlan@webtide.com). Both defenses are present and active: (1) part...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 9.4.53.v20231009 is NOT AFFECTED by CVE-2023-26048. The vulnerability (unbounded memory consumption from large non-file multipart parts) was fixed in upstream Jetty 9.4.51.v20230217. The target version 9.4.53 (October 2023) already includes this upstream fix from commit 1042cdb8a54 authored by Lachlan Roberts (lachlan@webtide.com). Both defenses are present and active: (1) part..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T15:00:07.396707+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 does not affect version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server. not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values with embedded semicolons) is NOT present in Jetty 9.4.53.v20231009. The upstream fix (commit 1be1401bafb from PR #9352, Feb 2023) was already included in the upstream release that TuxCare onboarded. The target code contains the defense: when parsing cookies in RFC6265 compliance mode, quoted values containing semicolons are rejected instead of ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-26049 (cookie smuggling via quoted values with embedded semicolons) is NOT present in Jetty 9.4.53.v20231009. The upstream fix (commit 1be1401bafb from PR #9352, Feb 2023) was already included in the upstream release that TuxCare onboarded. The target code contains the defense: when parsing cookies in RFC6265 compliance mode, quoted values containing semicolons are rejected instead of ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "action_statement": "Vulnerability CVE-2023-40167 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 is fixed in version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2024-13009"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server, and is fixed in 9.4.53.v20231009-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "action_statement": "Vulnerability CVE-2024-6763 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server, and is fixed in 9.4.53.v20231009-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "action_statement": "Vulnerability CVE-2024-7708 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 is fixed in version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2024-8184"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server, and is fixed in 9.4.53.v20231009-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      },
      "action_statement": "Vulnerability CVE-2025-11143 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server, and is fixed in 9.4.53.v20231009-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-1948 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2025-1948"
      },
      "action_statement": "Vulnerability CVE-2025-1948 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "action_statement": "Vulnerability CVE-2026-10051 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server. Version 9.4.53.v20231009 is not vulnerable. Summary: CVE-2026-1605 does not apply to this Jetty version. The target repository is running Jetty 9.4.53, while the CVE specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.1.5. The vulnerability is related to InflaterPool resource management in Jetty 12.x's completely redesigned architecture, which does not exist in Jetty 9.4.x. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 9.4.53.v20231009 is not vulnerable. Summary: CVE-2026-1605 does not apply to this Jetty version. The target repository is running Jetty 9.4.53, while the CVE specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.1.5. The vulnerability is related to InflaterPool resource management in Jetty 12.x's completely redesigned architecture, which does not exist in Jetty 9.4.x. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      },
      "action_statement": "Vulnerability CVE-2026-2332 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "action_statement": "Vulnerability CVE-2026-6790 affects version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-java-server@9.4.53.v20231009-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 9.4.53.v20231009-tuxcare.2 of org.eclipse.jetty:jetty-alpn-java-server. not_affected \u2014 Jetty 9.4.53.v20231009 is NOT affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8's single-pass canonicalPath() implementation where semicolon parameter processing fails to update the slash state variable, preventing dot segment detection. Jetty 9.4 uses a fundamentally different two-pass architecture (decodePath then canonicalPath) that correctly normalizes paths containing sem...",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 Jetty 9.4.53.v20231009 is NOT affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8's single-pass canonicalPath() implementation where semicolon parameter processing fails to update the slash state variable, preventing dot segment detection. Jetty 9.4 uses a fundamentally different two-pass architecture (decodePath then canonicalPath) that correctly normalizes paths containing sem..."
    }
  ]
}