{
  "@id": "urn:uuid:1b07625c-b2b1-4b96-9a94-504c5a65fa22",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T01:45:09.863951+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-28169 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-servlets. Version 9.4.59 is not vulnerable. Summary: CVE-2021-28169 has been resolved in this repository. The ConcatServlet contains the necessary protections against double-encoded path attacks targeting WEB-INF and META-INF directories. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28169"
      },
      "impact_statement": "Version 9.4.59 is not vulnerable. Summary: CVE-2021-28169 has been resolved in this repository. The ConcatServlet contains the necessary protections against double-encoded path attacks targeting WEB-INF and META-INF directories. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-36479 does not affect version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-servlets. Version 9.4.59 is not vulnerable. Summary: CVE-2023-36479 mitigation has been applied. The CGI servlet has been deprecated and removed from all configurations. While the vulnerable code pattern still exists in the source code (command wrapping logic in CGI.java lines 346-359), the servlet is not configured or exposed in any web.xml files, preventing exploitation. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "vulnerability": {
        "name": "CVE-2023-36479"
      },
      "impact_statement": "Version 9.4.59 is not vulnerable. Summary: CVE-2023-36479 mitigation has been applied. The CGI servlet has been deprecated and removed from all configurations. While the vulnerable code pattern still exists in the source code (command wrapping logic in CGI.java lines 346-359), the servlet is not configured or exposed in any web.xml files, preventing exploitation. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6762 affects version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-servlets.",
      "vulnerability": {
        "name": "CVE-2024-6762"
      },
      "action_statement": "Vulnerability CVE-2024-6762 affects version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-servlets."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.59.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-9823 affects version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-servlets.",
      "vulnerability": {
        "name": "CVE-2024-9823"
      },
      "action_statement": "Vulnerability CVE-2024-9823 affects version 9.4.59.tuxcare0002 of org.eclipse.jetty:jetty-servlets."
    }
  ]
}