{
  "@id": "urn:uuid:e6f5da75-887b-4b50-8200-b7cb3c986fb3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:57:45.485772+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-xml@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-58qw-p7qm-5rvh does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-xml. not_affected \u2014 The target contains the upstream vendor fix (commit d4d8832b11f) that addresses GHSA-58qw-p7qm-5rvh by adding customization hooks (newSAXParserFactory(), getSAXParser()) to XmlParser. The vendor explicitly defines the fix as \"Ability to configure the SAXParserFactory\" rather than enforcing default XXE protections. The vulnerable pattern (inability to customize SAXParserFactory) is not present i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-58qw-p7qm-5rvh"
      },
      "impact_statement": "not_affected \u2014 The target contains the upstream vendor fix (commit d4d8832b11f) that addresses GHSA-58qw-p7qm-5rvh by adding customization hooks (newSAXParserFactory(), getSAXParser()) to XmlParser. The vendor explicitly defines the fix as \"Ability to configure the SAXParserFactory\" rather than enforcing default XXE protections. The vulnerable pattern (inability to customize SAXParserFactory) is not present i..."
    }
  ]
}