{
  "@id": "urn:uuid:0b49c49e-069e-46c1-92b9-5b30de06c633",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T17:59:04.930040+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "action_statement": "Vulnerability CVE-2006-6969 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:41:42.084809+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "action_statement": "Vulnerability CVE-2011-4461 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "action_statement": "Vulnerability CVE-2015-2080 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "action_statement": "Vulnerability CVE-2016-4800 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "action_statement": "Vulnerability CVE-2017-7656 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "action_statement": "Vulnerability CVE-2017-7658 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "action_statement": "Vulnerability CVE-2017-9735 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T17:59:04.930040+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 does not affect version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner. not_affected \u2014 CVE-2018-12536 is NOT AFFECTED in Jetty 9.4.48.v20220622. The vulnerability (path disclosure via InvalidPathException in error responses) was fixed in upstream commit ad4dceb1c08 (2018-05-31) by adding exception sanitization to ResourceContentFactory. This fix was already present in the upstream Jetty 9.4.48 release (2022-06-22) when TuxCare onboarded it in 2025. In the default/shipped configur...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-12536 is NOT AFFECTED in Jetty 9.4.48.v20220622. The vulnerability (path disclosure via InvalidPathException in error responses) was fixed in upstream commit ad4dceb1c08 (2018-05-31) by adding exception sanitization to ResourceContentFactory. This fix was already present in the upstream Jetty 9.4.48 release (2022-06-22) when TuxCare onboarded it in 2025. In the default/shipped configur..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "action_statement": "Vulnerability CVE-2018-12545 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T15:56:00.085929+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 does not affect version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner. not_affected \u2014 The target (Jetty 9.4.48.v20220622-tuxcare.5) is not affected by CVE-2019-10241 (XSS in directory listings via specially formatted URLs). The upstream fix was already present in version 9.4.48 before TuxCare maintenance began. The vulnerable code pattern\u2014naive string manipulation on getName() to extract filenames for directory listings\u2014has been completely replaced with a secure getFileName() me...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "impact_statement": "not_affected \u2014 The target (Jetty 9.4.48.v20220622-tuxcare.5) is not affected by CVE-2019-10241 (XSS in directory listings via specially formatted URLs). The upstream fix was already present in version 9.4.48 before TuxCare maintenance began. The vulnerable code pattern\u2014naive string manipulation on getName() to extract filenames for directory listings\u2014has been completely replaced with a secure getFileName() me..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "action_statement": "Vulnerability CVE-2019-10246 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T16:21:21.678062+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 does not affect version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner. not_affected \u2014 CVE-2019-10247: Target Eclipse Jetty 9.4.48.v20220622-tuxcare.5 is NOT AFFECTED. The vulnerability (information disclosure of base resource filesystem paths in 404 error pages) is not present because the upstream vendor (Eclipse Jetty) fixed it in commit 04c994712c0 by Joakim Erdfelt, which was already part of the release when TuxCare onboarded this version. The vulnerable code pattern (calls t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-10247: Target Eclipse Jetty 9.4.48.v20220622-tuxcare.5 is NOT AFFECTED. The vulnerability (information disclosure of base resource filesystem paths in 404 error pages) is not present because the upstream vendor (Eclipse Jetty) fixed it in commit 04c994712c0 by Joakim Erdfelt, which was already part of the release when TuxCare onboarded this version. The vulnerable code pattern (calls t..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "action_statement": "Vulnerability CVE-2019-17632 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "action_statement": "Vulnerability CVE-2019-17638 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "action_statement": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "action_statement": "Vulnerability CVE-2020-27218 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "action_statement": "Vulnerability CVE-2020-27223 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "action_statement": "Vulnerability CVE-2021-28165 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner. Version 9.4.48.v20220622 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "Version 9.4.48.v20220622 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T16:22:12.450965+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "action_statement": "Vulnerability CVE-2021-34429 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T14:39:25.327988+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner. not_affected \u2014 The target repository (Jetty 9.4.48.v20220622-tuxcare.5) is NOT AFFECTED by CVE-2022-2047. The vulnerability involves incorrect URI parsing where URIs like `http://localhost;/path` would parse with host as `localhost;` instead of being rejected. The upstream fix (commit 4ca8afbbd667c19a084d5ff14a4f08eb7049d1c7) was already included in the upstream release 9.4.48.v20220622 that TuxCare onboarded...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 9.4.48.v20220622-tuxcare.5) is NOT AFFECTED by CVE-2022-2047. The vulnerability involves incorrect URI parsing where URIs like `http://localhost;/path` would parse with host as `localhost;` instead of being rejected. The upstream fix (commit 4ca8afbbd667c19a084d5ff14a4f08eb7049d1c7) was already included in the upstream release 9.4.48.v20220622 that TuxCare onboarded..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "action_statement": "Vulnerability CVE-2022-2191 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2023-26048"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2023-26049"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2023-40167"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2024-13009"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-30T21:32:38.446662+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner, and is fixed in 9.4.48.v20220622-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "action_statement": "Vulnerability CVE-2024-6763 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner, and is fixed in 9.4.48.v20220622-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "action_statement": "Vulnerability CVE-2024-7708 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "action_statement": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      },
      "action_statement": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2026-10050"
      },
      "action_statement": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ...",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T09:57:05.047023+00:00",
      "status_notes": "Vulnerability CVE-2026-18659 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2026-18659"
      },
      "action_statement": "Vulnerability CVE-2026-18659 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T09:43:02.853292+00:00",
      "status_notes": "Vulnerability CVE-2026-18661 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2026-18661"
      },
      "action_statement": "Vulnerability CVE-2026-18661 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T09:57:05.047023+00:00",
      "status_notes": "Vulnerability CVE-2026-18662 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2026-18662"
      },
      "action_statement": "Vulnerability CVE-2026-18662 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T09:57:05.047023+00:00",
      "status_notes": "Vulnerability CVE-2026-19864 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2026-19864"
      },
      "action_statement": "Vulnerability CVE-2026-19864 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      },
      "action_statement": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "action_statement": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-runner@9.4.48.v20220622-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.48.v20220622-tuxcare.3 of org.eclipse.jetty:jetty-runner.",
      "vulnerability": {
        "name": "GHSA-58qw-p7qm-5rvh"
      }
    }
  ]
}