{
  "@id": "urn:uuid:1afb6de1-825b-4dac-b49f-e59b027875e7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:57:45.485772+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-28169 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-servlets. Version 9.4.60 is not vulnerable. Summary: CVE-2021-28169 has been patched in the target repository. The ConcatServlet now properly validates paths before dispatching, preventing double-encoded path traversal attacks to access WEB-INF/META-INF protected resources. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28169"
      },
      "impact_statement": "Version 9.4.60 is not vulnerable. Summary: CVE-2021-28169 has been patched in the target repository. The ConcatServlet now properly validates paths before dispatching, preventing double-encoded path traversal attacks to access WEB-INF/META-INF protected resources. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-36479 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 The upstream vendor (Eclipse Jetty) applied their chosen mitigation for CVE-2023-36479 by deprecating the entire CGI servlet class in commit ec7e1fd173 (June 2023). While the vulnerable escaping code remains present at lines 350-351, the vendor's official position is \"do not use, no replacement, will be removed in a future release.\" The @Deprecated annotation and removal from test configuration...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-36479"
      },
      "impact_statement": "not_affected \u2014 The upstream vendor (Eclipse Jetty) applied their chosen mitigation for CVE-2023-36479 by deprecating the entire CGI servlet class in commit ec7e1fd173 (June 2023). While the vulnerable escaping code remains present at lines 350-351, the vendor's official position is \"do not use, no replacement, will be removed in a future release.\" The @Deprecated annotation and removal from test configuration..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-6762 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-servlets. not_affected \u2014 CVE-2024-6762 affects Jetty's PushSessionCacheFilter and PushCacheFilter due to unbounded cache growth leading to memory exhaustion. The target repository (Jetty 9.4.63, commit 7267af07102) contains the upstream vendor's fix, which deprecates both filters and adds explicit warnings that they are \"example class not suitable for production.\" The fix was authored by upstream Jetty developer Lachla...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-6762"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-6762 affects Jetty's PushSessionCacheFilter and PushCacheFilter due to unbounded cache growth leading to memory exhaustion. The target repository (Jetty 9.4.63, commit 7267af07102) contains the upstream vendor's fix, which deprecates both filters and adds explicit warnings that they are \"example class not suitable for production.\" The fix was authored by upstream Jetty developer Lachla..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2024-9823 affects version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-servlets.",
      "vulnerability": {
        "name": "CVE-2024-9823"
      },
      "action_statement": "Vulnerability CVE-2024-9823 affects version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-servlets."
    }
  ]
}