{ "@id": "urn:uuid:06008915-9b70-4cde-8466-b1efcea760aa", "role": "Document Creator", "author": "https://tuxcare.com", "version": 12, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-30T14:57:45.485772+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-2047 affects version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http.", "vulnerability": { "name": "CVE-2022-2047" }, "action_statement": "Vulnerability CVE-2022-2047 affects version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-2048 is fixed in version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http.", "vulnerability": { "name": "CVE-2022-2048" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36478 affects version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http.", "vulnerability": { "name": "CVE-2023-36478" }, "action_statement": "Vulnerability CVE-2023-36478 affects version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40167 is fixed in version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http.", "vulnerability": { "name": "CVE-2023-40167" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41900 is fixed in version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http.", "vulnerability": { "name": "CVE-2023-41900" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-44487 is fixed in version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http.", "vulnerability": { "name": "CVE-2023-44487" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22201 is fixed in version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http.", "vulnerability": { "name": "CVE-2024-22201" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6763 affects version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http.", "vulnerability": { "name": "CVE-2024-6763" }, "action_statement": "Vulnerability CVE-2024-6763 affects version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11143 is fixed in version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http.", "vulnerability": { "name": "CVE-2025-11143" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-5115 is fixed in version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http.", "vulnerability": { "name": "CVE-2025-5115" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2332 affects version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http.", "vulnerability": { "name": "CVE-2026-2332" }, "action_statement": "Vulnerability CVE-2026-2332 affects version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8384 does not affect version 9.4.41.v20210516-tuxcare.4 of org.eclipse.jetty:jetty-http. not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-8384. The target version includes upstream fixes from February 2021 (issue #4275, commits 20ef71fe5d7 and f9b5974dedf) that add ambiguous URI path parameter checking. These fixes prevent exploitation of the semicolon-followed-by-dot-segment pattern described in the CVE by rejecting such URIs with a BadMessageException before they reach security...", "vulnerability": { "name": "CVE-2026-8384" }, "impact_statement": "not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-8384. The target version includes upstream fixes from February 2021 (issue #4275, commits 20ef71fe5d7 and f9b5974dedf) that add ambiguous URI path parameter checking. These fixes prevent exploitation of the semicolon-followed-by-dot-segment pattern described in the CVE by rejecting such URIs with a BadMessageException before they reach security..." } ] }