Hi, committer to the https://github.com/jetty/jetty.project here. PR #5064 should not have been merged. (see commit 6e7e76a42d0319eb4323c7e0e519d151ff5dccad) The 2 listed URLs in that PR have nothing to do with the vulnerability for CVE-2024-8184 and GHSA-g8m5-722r-8whq. They are separate concepts against the same classes and do not address the vulnerability.