Re: [jetty-users] Security Advisory GHSA-2fvj-hgj9-j2gr?

[Jesse McConnell <jesse.mcconnell@xxxxxxxxx>]

Please read: https://github.com/jetty/jetty.project/issues/13918

If you would like to talk about it, feel free to book an appointment with me here: https://webtide.com/book/

cheers,

Jesse

--
jesse mcconnell
jesse.mcconnell@xxxxxxxxx

On Mon, Sep 14, 2026 at 2:48 AM Joerg Hoh via jetty-users <jetty-users@xxxxxxxxxxx> wrote:

Hi,

I have a question regarding the security advisory published at https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr?

It lists these patched versions for org.eclipse.jetty:jetty-security 

9.4.x : 9.4.62

10.0.x: 10.0.31 

11.0.x: 11.0.31

But all of them are not available at Maven Central (https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-security/). They also don’t exist in git.

I understand that these branches are EOL.

My question is: Can you fix your advisory and just list the branches for which patched versions are available? 

Thanks,

Jörg

-- 

Jörg Hoh  

Joerg.Hoh@xxxxxxxxx
Adobe Systems Engineering GmbH - Grosse Elbstrasse 27 - 22767 Hamburg

Sitz der Gesellschaft: Hamburg - Registergericht: Hamburg HRB 745 37 

Geschäftsführer: Michael D. Jamrosy, Christian Keim, Thomas Mührke, Scott Andrew Kennedy

_______________________________________________
jetty-users mailing list
jetty-users@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-users