{
  "@id": "urn:uuid:229a1cca-c1d7-497c-823c-3a10f25876a8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2006-6969 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2006-6969"
      },
      "action_statement": "Vulnerability CVE-2006-6969 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:41:42.084809+00:00",
      "status_notes": "Vulnerability CVE-2011-4461 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2011-4461"
      },
      "action_statement": "Vulnerability CVE-2011-4461 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2015-2080 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2015-2080"
      },
      "action_statement": "Vulnerability CVE-2015-2080 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:31:18.734944+00:00",
      "status_notes": "Vulnerability CVE-2016-4800 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2016-4800"
      },
      "action_statement": "Vulnerability CVE-2016-4800 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7656 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2017-7656"
      },
      "action_statement": "Vulnerability CVE-2017-7656 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-7657 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2017-7657"
      },
      "action_statement": "Vulnerability CVE-2017-7657 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2017-7658 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2017-7658"
      },
      "action_statement": "Vulnerability CVE-2017-7658 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2017-9735 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2017-9735"
      },
      "action_statement": "Vulnerability CVE-2017-9735 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2018-12536 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2018-12536"
      },
      "action_statement": "Vulnerability CVE-2018-12536 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12538 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2018-12538"
      },
      "action_statement": "Vulnerability CVE-2018-12538 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:08:54.384014+00:00",
      "status_notes": "Vulnerability CVE-2018-12545 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2018-12545"
      },
      "action_statement": "Vulnerability CVE-2018-12545 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2019-10241 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2019-10241"
      },
      "action_statement": "Vulnerability CVE-2019-10241 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2019-10246 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2019-10246"
      },
      "action_statement": "Vulnerability CVE-2019-10246 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2019-10247 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2019-10247"
      },
      "action_statement": "Vulnerability CVE-2019-10247 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2019-17632 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2019-17632"
      },
      "action_statement": "Vulnerability CVE-2019-17632 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2019-17638 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2019-17638"
      },
      "action_statement": "Vulnerability CVE-2019-17638 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27218 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2020-27218"
      },
      "action_statement": "Vulnerability CVE-2020-27218 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2020-27223 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2020-27223"
      },
      "action_statement": "Vulnerability CVE-2020-27223 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2021-28165 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2021-28165"
      },
      "action_statement": "Vulnerability CVE-2021-28165 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2021-34428 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket. not_affected \u2014 CVE-2021-34428 is a Jetty session-invalidation flaw: if an application's SessionListener#sessionDestroyed() throws, the pre-fix Session.invalidate() skipped SessionIdManager.invalidateAll(), leaving the session ID registered in the ID manager. On clustered / multi-context deployments the session stays valid and a user can remain logged in on a shared computer. The upstream fix (commit 087f486b4461, \"Issue #6277 Better handling of exceptions thrown in sessionDestroyed\", tagged jetty-9.4.41.v20210516) wraps the destroy-listener call in try/catch(Exception) and moves getSessionIdManager().invalidateAll(id) into the finally block so ID removal always runs. Target is jetty-9.4.51.v20230217 (newer than the 9.4.41 fix). Session.java lines 942-958 contain the exact post-fix try/catch/finally; git blame attributes the catch (947-949) and the invalidateAll-in-finally (956-957) to the patch commit itself, authored by Jan Bartel <janb@webtide.com> (upstream Webtide). The fix is stock upstream baked into the onboarded release (ancestor of both parents of the TuxCare onboarding merge; not introduced by it), not a TuxCare backport. Verdict: not_affected \u2014 upstream fix already present in the shipped version; vulnerable pattern absent from HEAD. Justification: code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-23; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34428"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34428 is a Jetty session-invalidation flaw: if an application's SessionListener#sessionDestroyed() throws, the pre-fix Session.invalidate() skipped SessionIdManager.invalidateAll(), leaving the session ID registered in the ID manager. On clustered / multi-context deployments the session stays valid and a user can remain logged in on a shared computer. The upstream fix (commit 087f486b4461, \"Issue #6277 Better handling of exceptions thrown in sessionDestroyed\", tagged jetty-9.4.41.v20210516) wraps the destroy-listener call in try/catch(Exception) and moves getSessionIdManager().invalidateAll(id) into the finally block so ID removal always runs. Target is jetty-9.4.51.v20230217 (newer than the 9.4.41 fix). Session.java lines 942-958 contain the exact post-fix try/catch/finally; git blame attributes the catch (947-949) and the invalidateAll-in-finally (956-957) to the patch commit itself, authored by Jan Bartel <janb@webtide.com> (upstream Webtide). The fix is stock upstream baked into the onboarded release (ancestor of both parents of the TuxCare onboarding merge; not introduced by it), not a TuxCare backport. Verdict: not_affected \u2014 upstream fix already present in the shipped version; vulnerable pattern absent from HEAD. Justification: code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-23; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "action_statement": "Vulnerability CVE-2022-2047 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2022-2191 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2022-2191"
      },
      "action_statement": "Vulnerability CVE-2022-2191 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2023-26048 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2023-26048"
      },
      "action_statement": "Vulnerability CVE-2023-26048 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2023-26049 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2023-26049"
      },
      "action_statement": "Vulnerability CVE-2023-26049 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "action_statement": "Vulnerability CVE-2023-40167 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2024-13009 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2024-13009"
      },
      "action_statement": "Vulnerability CVE-2024-13009 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "action_statement": "Vulnerability CVE-2024-6763 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2024-7708 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2024-7708"
      },
      "action_statement": "Vulnerability CVE-2024-7708 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2024-8184 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2024-8184"
      },
      "action_statement": "Vulnerability CVE-2024-8184 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      },
      "action_statement": "Vulnerability CVE-2025-11143 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2026-10051 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket. not_affected \u2014 Jetty 9.4.51.v20230217 is not affected by CVE-2026-10051 because the vulnerable pattern (trailers not being cleared between requests) does not exist in this version. The CVE describes a vulnerability in Jetty 12.x's HttpConnection where the _trailers field was never cleared between HTTP/1.1 keep-alive requests. However, Jetty 9.4.x uses a different architecture (HttpChannelOverHttp) that proper...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-10051"
      },
      "impact_statement": "not_affected \u2014 Jetty 9.4.51.v20230217 is not affected by CVE-2026-10051 because the vulnerable pattern (trailers not being cleared between requests) does not exist in this version. The CVE describes a vulnerability in Jetty 12.x's HttpConnection where the _trailers field was never cleared between HTTP/1.1 keep-alive requests. However, Jetty 9.4.x uses a different architecture (HttpChannelOverHttp) that proper..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2026-1605 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket. Jetty 9.4.51.v20230217 uses a fundamentally different architecture than the vulnerable Jetty 12.x described in CVE-2026-1605. The CVE-specific vulnerability pattern requires GzipRequest with InflaterPool where cleanup is conditional on response deflation. Jetty 9.4.51 lacks these components entirely (GzipRequest, GzipResponseAndCallback, pooled Inflaters) and instead uses GzipHttpInputInterceptor with direct Inflater creation and deferred cleanup via HttpInput.recycle(). The specific chain from Input to Goal (pool exhaustion leading to permanent memory leak) is not reachable in this version's architecture.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-1605"
      },
      "impact_statement": "Jetty 9.4.51.v20230217 uses a fundamentally different architecture than the vulnerable Jetty 12.x described in CVE-2026-1605. The CVE-specific vulnerability pattern requires GzipRequest with InflaterPool where cleanup is conditional on response deflation. Jetty 9.4.51 lacks these components entirely (GzipRequest, GzipResponseAndCallback, pooled Inflaters) and instead uses GzipHttpInputInterceptor with direct Inflater creation and deferred cleanup via HttpInput.recycle(). The specific chain from Input to Goal (pool exhaustion leading to permanent memory leak) is not reachable in this version's architecture."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      },
      "action_statement": "Vulnerability CVE-2026-2332 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2026-6790 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket.",
      "vulnerability": {
        "name": "CVE-2026-6790"
      },
      "action_statement": "Vulnerability CVE-2026-6790 affects version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-unixsocket@9.4.51.v20230217-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-30T16:08:06.197770+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 does not affect version 9.4.51.v20230217-tuxcare.1 of org.eclipse.jetty:jetty-unixsocket. not_affected \u2014 The target (Jetty 9.4.51.v20230217) is not affected by CVE-2026-8384. While the CVE describes a path normalization bypass in Jetty 12.1.8 where URIUtil.canonicalPath() fails to normalize paths containing `;/../` patterns due to incorrect slash-state tracking, Jetty 9.4.x uses a fundamentally different two-step architecture that prevents this vulnerability. The target's HttpURI.getDecodedPath() ...",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "impact_statement": "not_affected \u2014 The target (Jetty 9.4.51.v20230217) is not affected by CVE-2026-8384. While the CVE describes a path normalization bypass in Jetty 12.1.8 where URIUtil.canonicalPath() fails to normalize paths containing `;/../` patterns due to incorrect slash-state tracking, Jetty 9.4.x uses a fundamentally different two-step architecture that prevents this vulnerability. The target's HttpURI.getDecodedPath() ..."
    }
  ]
}