{ "@id": "urn:uuid:cc52bbdc-41f6-4860-8895-2c8e102a81a1", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-09-24T09:31:26.931840+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-27216 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2020-27216" }, "action_statement": "Vulnerability CVE-2020-27216 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-28169 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2021-28169" }, "action_statement": "Vulnerability CVE-2021-28169 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-34428 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2021-34428" }, "action_statement": "Vulnerability CVE-2021-34428 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36478 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2023-36478" }, "action_statement": "Vulnerability CVE-2023-36478 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36479 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2023-36479" }, "action_statement": "Vulnerability CVE-2023-36479 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40167 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2023-40167" }, "action_statement": "Vulnerability CVE-2023-40167 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41900 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2023-41900" }, "action_statement": "Vulnerability CVE-2023-41900 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22201 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2024-22201" }, "action_statement": "Vulnerability CVE-2024-22201 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6762 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2024-6762" }, "action_statement": "Vulnerability CVE-2024-6762 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6763 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2024-6763" }, "action_statement": "Vulnerability CVE-2024-6763 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8184 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2024-8184" }, "action_statement": "Vulnerability CVE-2024-8184 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11143 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2025-11143" }, "action_statement": "Vulnerability CVE-2025-11143 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-5115 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2025-5115" }, "action_statement": "Vulnerability CVE-2025-5115 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10050 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2026-10050" }, "action_statement": "Vulnerability CVE-2026-10050 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10051 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2026-10051" }, "action_statement": "Vulnerability CVE-2026-10051 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1605 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2026-1605" }, "action_statement": "Vulnerability CVE-2026-1605 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2332 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2026-2332" }, "action_statement": "Vulnerability CVE-2026-2332 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-5795 is fixed in version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2026-5795" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6790 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "CVE-2026-6790" }, "action_statement": "Vulnerability CVE-2026-6790 affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8384 does not affect version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server. not_affected \u2014 Jetty 9.4.58.v20250814 is not affected by CVE-2026-8384. The vulnerability exists only in Jetty 12's refactored canonicalPath() implementation that combines path decoding and canonicalization with slash-state tracking. Jetty 9.4 uses a two-stage architecture (decodePath() followed by canonicalPath()) that correctly normalizes paths containing semicolon path parameters before dot-dot segments, p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-8384" }, "impact_statement": "not_affected \u2014 Jetty 9.4.58.v20250814 is not affected by CVE-2026-8384. The vulnerability exists only in Jetty 12's refactored canonicalPath() implementation that combines path decoding and canonicalization with slash-state tracking. Jetty 9.4 uses a two-stage architecture (decodePath() followed by canonicalPath()) that correctly normalizes paths containing semicolon path parameters before dot-dot segments, p..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.58.v20250814-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server.", "vulnerability": { "name": "GHSA-58qw-p7qm-5rvh" }, "action_statement": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 9.4.58.v20250814-tuxcare.2 of org.eclipse.jetty:jetty-alpn-conscrypt-server." } ] }